Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Description: Detects the Stage 2 C2 tasking loop from the malicious Next.js developer-targeting campaign.Stage 2 spawns a child Node.js process and executes attacker-supplied JavaScript via STDIN ('-') or eval ('-e'), sourced from a parent Node process that previously beaconed to Vercel staging infrastructure. Trojanized assets involved include jquery.min.js and env-setup.js loaded from
known malicious repo structures.
known malicious repo structures.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
Detects portable Node.js binaries executing from C:\ProgramData, which can be indicative of malware like Lorem Ipsum or EtherRAT. This rule specifically looks for 'node.exe' processes running from the 'C:\ProgramData\' directory with a command line containing '.js'.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects the execution of 'node.exe' with 'Update.js' in its command line. This pattern is associated with the primary dropper for the 'Lorem Ipsum' malware.
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 24 of 28