Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects Node.js or NPM process executions that reference Twilio-specific credential variables (ACCOUNT_SID, AUTH_TOKEN) within the command line, likely indicating an attempt to harvest these secrets from a developer environment.
The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder.
Legitimate Node.js application, module, and package manager directories are excluded.
This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.
Legitimate Node.js application, module, and package manager directories are excluded.
This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.
Detects instances where the Node.js runtime process (node.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is frequently used by malicious Node.js-based applications, RATs, or web shells to execute arbitrary commands on a compromised host.
Detects the presence of package.json or node_modules artifacts associated with a known typosquatting campaign targeting the 'sorted-btree' npm package. The rule identifies suspicious package names or dependencies by matching against a list of known malicious packages used in the campaign, or by detecting the co-occurrence of the malicious 'indexed-btree' package alongside the legitimate 'sorted-btree' package.
Detects instances where Node.js, Python, or Go processes spawn command shell interpreters (cmd.exe, powershell.exe, etc.). This behavior is often indicative of C2 command execution by malware, such as the Graphalgo RAT, which may use these languages to execute shell-level commands after initial infection or payload execution.
Detects the execution of the sckit Go implant, linked to the MemTensor supply chain compromise, during its host-profiling stage. The rule monitors for the 'sckit' binary being executed with 'stage0' and '--config64' command-line arguments, or being spawned by legitimate runtime interpreters like Node.js or Python, indicating an attempt to profile host information (timezone, language, privileges) and subsequent self-deletion.
This rule detects suspicious PowerShell execution initiated by a Node.js process (node.exe). It monitors for command lines containing common bypass flags (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) and a specific string pattern 'wra-ps-', which is often associated with malicious scripts or remote access trojans (RATs) being executed via a Node.js application.
Detects a multi-stage loader execution chain, potentially named GHAPPIER, by identifying sequential stages of execution. These stages include initial marker file checks, shell-based command dispatching via curl/wget, renaming and execution of secondary payloads, Node.js-based runtime staging, and the eventual creation of implant artifacts in common paths such as VSCode extensions or hidden directories.
Detects instances where the Node.js runtime process (node.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is frequently used by malicious Node.js-based applications, RATs, or web shells to execute arbitrary commands on a compromised host.
Detects suspicious command-line patterns typically used for downloading or executing malicious payloads, such as curl, base64 encoding, and PowerShell web requests, when spawned directly from Node.js or Visual Studio Code processes. This behavior is associated with supply chain compromises and loader activity (e.g., WaterPlum/Contagious Interview) targeting development environments.
This rule monitors for the installation of specific known-malicious or suspicious NPM packages that are commonly used in supply chain attacks. It identifies the execution of npm (or node) commands to install or add packages explicitly listed as malicious by security research, which may indicate a supply chain compromise or an attempt to introduce unauthorized code into the development environment.
Detects common runtime processes (Node.js, npx, Python) often used for Model Context Protocol (MCP) servers accessing sensitive local credential files such as AWS credentials, SSH private keys, or environment files. This behavior is indicative of potential credential harvesting by unauthorized MCP servers in developer environments.
Detects the execution of the 'sckit' Go-based implant when spawned by Node.js or Python processes using the command-line arguments 'stage0 --config64'. This pattern is associated with malicious npm and PyPI supply chain packages (memtensor) designed to harvest credentials and establish persistence.
Detects Node.js processes establishing network connections to common webhook relay and collection services, which may indicate data exfiltration or credential theft.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
This rule detects the execution of common Node.js package managers (npm, yarn, pnpm) attempting to install specific dependencies that match known patterns of malicious or typosquatted packages often used in supply chain attacks. The detection focuses on suspicious package names that mimic common data structure library naming conventions.
Detects instances where the Node.js process (node.exe) is executed with a command-line argument referencing 'sharedLoad.min.js'. This is often used in web-based applications or potentially malicious obfuscated scripts, but may flag legitimate JavaScript automation tasks.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Page 2 of 28