Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects rapid access to multiple sensitive developer credential files (e.g., AWS, Kubernetes, Docker, SSH keys, npm, Git, and crypto wallets) by a single process within a 5-minute window, a pattern indicative of automated credential harvesting.
Teampcp Shell Recon
YARA-L
Tracks shell reconnaissance parsing /var/log/auth.log for successful logins or executing env | grep AWS_.
Detects processes that masquerade as the legitimate 'systemd-userdbd' system service by spoofing their process name. This behavior is commonly associated with malware, such as the MYRA RAT, which uses prctl to alter its process display name to evade detection.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects execution of potentially malicious npm lifecycle scripts (preinstall/postinstall) associated with the Polymarket Trap supply chain campaign. The rule monitors node.exe spawning specific known-malicious scripts or executing shell commands via cmd.exe, often related to attacker-controlled dependency packages.
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
Detects unexpected shell or script interpreter processes (e.g., sh, bash, python, perl, nc, curl, wget) spawned as children of media processing applications like ffmpeg or ffprobe, especially when running under service accounts associated with Jellyfin, Nextcloud, or Emby. This behavior could indicate exploitation of a vulnerability (e.g., CVE-2026-8461 / PixelSmash) allowing arbitrary command execution.
This rule detects the presence of components associated with the MYRA rootkit, including specific filenames ('libcache.so', 'memfd_loader') and references to the 'apintergrationpost' npm package or the author 'kimijohn01'. It monitors process command lines, file events, and syslog messages for these indicators.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
Page 230 of 347