Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects Node.js orchestrating the SentinelOne memory scanner for evasion and targeted DLL sideloading. This behavior is indicative of an adversary attempting to use legitimate tools in an unexpected way, potentially to bypass security controls or perform malicious actions under the guise of a trusted process.
Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects Node.js initiating connections over port 2222. This is used by the Miasma botnet as a fallback C2/SSH channel when standard ports are blocked.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects the execution of Python or Node.js processes that include command-line arguments indicative of base64 decoding or zlib decompression, often used for deobfuscating and executing malicious payloads in memory.
Identifies Node.js initiating exfiltration connections to the C2 with parameters indicating disabled TLS certificate validation.
Detects the modification of Windows Registry run keys by node.exe. This activity is often used by adversaries to establish persistence, where a malicious Node.js script or application is set to automatically execute upon user logon.
Detects the execution of Node.js build processes (node-gyp) or npm build commands involving native module compilation. These patterns are often indicative of legitimate development workflows but are also leveraged by attackers to compile malicious native add-ons or execute arbitrary code in a build environment.
This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.
Page 23 of 28