Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects execution of potentially malicious npm lifecycle scripts (preinstall/postinstall) associated with the Polymarket Trap supply chain campaign. The rule monitors node.exe spawning specific known-malicious scripts or executing shell commands via cmd.exe, often related to attacker-controlled dependency packages.
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
Detects unexpected shell or script interpreter processes (e.g., sh, bash, python, perl, nc, curl, wget) spawned as children of media processing applications like ffmpeg or ffprobe, especially when running under service accounts associated with Jellyfin, Nextcloud, or Emby. This behavior could indicate exploitation of a vulnerability (e.g., CVE-2026-8461 / PixelSmash) allowing arbitrary command execution.
This rule detects the presence of components associated with the MYRA rootkit, including specific filenames ('libcache.so', 'memfd_loader') and references to the 'apintergrationpost' npm package or the author 'kimijohn01'. It monitors process command lines, file events, and syslog messages for these indicators.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule correlates three suspicious behaviors occurring within 10 minutes: a non-root process identified as 'bumsrakete' executes, this process accesses the sensitive kernel memory file '/dev/mem', and subsequently, a root process is spawned that is not a standard privilege escalation utility (such as sudo, su, etc.). This sequence of events is highly indicative of potential malicious activity, such as kernel-level exploitation or unauthorized privilege escalation.
Detects unauthorized modification of file flags on core system binaries (e.g., /bin, /sbin, /usr/bin) followed by write/modification operations. This behavior is indicative of an attacker attempting to bypass immutable flags to modify or replace critical system files, often seen in rootkits or malware to achieve persistence or tamper with system integrity.
This rule detects potential supply chain compromise involving typosquatted npm packages. It monitors for the execution of npm packages with names closely resembling legitimate libraries (e.g., 'thirdweb', 'rainbownkit'), followed by suspicious post-install scripts that attempt to initiate network connections to known malicious domains or modify sensitive files.
This rule detects when a Node.js process accesses sensitive files associated with SSH configurations, private keys, or package manager credentials (such as .npmrc or .pypirc). Such behavior is highly unusual for legitimate web application processes and may indicate an attacker attempting to steal credentials or secrets from a compromised system.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
This rule detects successful SSH authentications using the GSSAPI-with-MIC mechanism. This can indicate legitimate user logins or, in some cases, an adversary using valid credentials to access a system via SSH.
Detects LampoRAT malware based on known file hash execution.
Page 222 of 341