Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects application log patterns indicative of a memory leak exploitation attempt against vLLM using the Python Imaging Library (PIL). This behavior is associated with an ASLR bypass technique leveraging BytesIO object manipulation, a prerequisite for a subsequent heap overflow vulnerability.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Detects the configuration of network tunnels or IPsec-related settings using tools such as ip, setkey, racoon, or strongswan by a non-root user. This behavior is indicative of potential unauthorized tunnel establishment or lateral movement activities where a standard user attempts to bypass network controls.
Detects Node.js process querying Ethereum blockchain for C2 address.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects outbound network connections from internal hosts to domains associated with the Polymarket Trap / Miasma infostealer campaign, including dedicated servers (stitch-production.org, log-taker.store) and vercel.app serverless endpoints used for credential exfiltration.
Detects persistence mechanisms associated with the MYRA Linux RAT, including the use of LD_PRELOAD to load a malicious shared library from a hidden path, persistent shell profile modification via /etc/profile.d/.sh.local, and process masquerading as systemd-userdbd. This rule is linked to the Polymarket Trap campaign involving malicious npm packages.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
This rule monitors for the Node.js process (node.exe or node) accessing common sensitive configuration files, SSH keys, cloud credentials, or environment files such as .ssh/id_rsa, .aws/credentials, .npmrc, and .docker/config.json. Such activity is often indicative of an adversary attempting to perform credential theft or environment discovery after gaining initial access via a compromised Node.js application.
This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.
This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.
Detects Node.js or npm processes accessing sensitive developer configuration and credential files. This rule is designed to identify malicious supply chain activity, specifically matching patterns where npm postinstall scripts or malicious node modules attempt to exfiltrate files such as .gitconfig, SSH keys, cloud credentials, and tokens from a developer workstation.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Page 195 of 347