Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.
Detects node.exe processes accessing sensitive AWS configuration files (credentials, config), .npmrc files, or suspicious data parsing utilities, indicative of the Polymarket Trap npm infostealer attempting to exfiltrate cloud credentials and tokens from developer workstations.
Detects instances where a Node.js process (e.g., node.exe) spawns standard system reconnaissance binaries such as whoami, hostname, systeminfo, ipconfig, or ifconfig. This behavior is indicative of malicious activity, specifically infostealer campaigns (like the Polymarket Trap / Miasma) that leverage npm postinstall scripts or other Node.js execution patterns to gather host and environment information from developer machines.
Detects node.exe (Node.js runtime) process initiating file read operations on sensitive files such as SSH keys, AWS credentials, Docker configuration files, GPG keyrings, or package manager configuration files (npmrc/pypirc). This behavior is characteristic of malicious npm packages or infostealers attempting to exfiltrate developer credentials, as observed in the Polymarket Trap supply chain campaign.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
This rule detects the execution of processes where the image path or parent process path originates from anonymous memory file descriptors ('/memfd:') or file descriptor links ('/proc/self/fd/'). These patterns are frequently associated with fileless malware execution where binaries are executed directly from memory to avoid disk-based detection.
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
Detects unauthorized access or modification attempts to cryptocurrency wallet files (specifically MetaMask and Phantom browser extensions) by non-browser processes. This behavior is indicative of credential theft or wallet exfiltration by malicious software.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
Detects potentially unauthorized or malicious loading of kernel modules on FreeBSD systems using the kldload command. The rule identifies suspicious activity by flagging modules loaded from non-standard directories, kldload processes spawned by untrusted parent processes (like web servers, shells, or scripts), and instances where the process was invoked with sudo/su by non-root users.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
Detects execution of the Tailscale or Tailscaled process that is not initiated by standard system or management processes. This may indicate unauthorized installation or use of the Tailscale VPN software for covert command and control or lateral movement, especially when combined with immediate network activity to Tailscale infrastructure or ports.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
This rule monitors and alerts on network connections established from endpoints to a predefined list of known malicious IP addresses, which may indicate command-and-control (C2) communication or unauthorized exfiltration attempts.
This rule detects network connections where the HTTP request URL or specific HTTP cookies match patterns often associated with command and control infrastructure or specific tracking beacons. It triggers on connections to 'financemachinelearning.com/apparatus/wind/twig/statement.html' or requests containing cookies like 'zd_cs_pm' or 'euconsent-v2'.
Detects network beaconing activity associated with the SPECTRALVIPER C2 framework. This rule identifies outbound HTTP GET requests targeting known C2 infrastructure domains and IP addresses, while correlating the traffic with specific browser user agents and cookie patterns indicative of this actor.
Page 208 of 347