Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects the execution of a malicious Node.js process using a fake ESLint loader named 'vscode-eioesocxetd.js'. This malware persists by modifying the global 'require' function and setting the 'global['!']' property to ensure its presence across process restarts, typically masquerading within npm package directories.
Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.
Detects evidence of the NodeBB ActivityPub UID spoofing proof-of-concept (PoC) script (poc.js). The rule identifies the execution of node processes using specific command-line arguments (--target-base, --actor-origin, --spoof-uid, --recipient-uid) associated with the exploit, as well as Node.js processes making outbound network connections to ActivityPub path components (/inbox, /activitypub) over non-standard network ports. This activity is indicative of vulnerability testing or exploitation attempts.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.
Detects MYRA RAT install-guard.js preinstall hook forcing re-execution with sudo npm install -g apintergrationpost to gain root privileges
Photo-themed ZIP phishing campaign dropping a Node.js implant
Photo-themed ZIP phishing campaign dropping a Node.js implant
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects execution of potentially malicious npm lifecycle scripts (preinstall/postinstall) associated with the Polymarket Trap supply chain campaign. The rule monitors node.exe spawning specific known-malicious scripts or executing shell commands via cmd.exe, often related to attacker-controlled dependency packages.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
Page 20 of 28