Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the Polymarket Trap / Miasma JavaScript-based infostealer attempting to access sensitive configuration files and credentials (SSH keys, AWS credentials, .npmrc, .pypirc, Docker config, and GPG keys) from a developer's workstation using node.js-related runtimes.
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects Node.js processes accessing sensitive configuration files such as .npmrc (npm authentication tokens) or .docker/config.json (docker registry credentials). This rule filters for activity within npm lifecycle script contexts (e.g., preinstall, postinstall hooks), which is a common technique used in software supply chain attacks to exfiltrate credentials.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
This rule detects the execution of a process named 'systemd-userdbd' that is either spawned from suspicious parent contexts (such as Node.js or npm, or from locations like /tmp/, /var/tmp/, node_modules, or .peer/) or is running from a non-standard file path. This behavior is indicative of malware, specifically the MYRA RAT, which uses this process name as a masquerade to evade detection.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
Detects node.js processes accessing sensitive configuration files, SSH keys, browser login databases, and other credential stores. This activity is indicative of malicious transitive dependencies within the npm ecosystem attempting to exfiltrate credentials during module initialization, even when top-level install scripts are restricted.
Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.
Page 227 of 341