Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects network connections from a node.js process to a known C2 server address (87.236.177.9:3000) used by DPRK-linked threat actors.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
Detects when a common web server process (node, nginx, apache, apache2, httpd) spawns `curl` or `wget`. This behavior is a strong indicator of post-exploitation activity, as seen in the exploitation of vulnerabilities like CVE-2025-55182 (React2Shell), where attackers download second-stage payloads.
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects the installation of malicious npm packages, such as 'node-nvm-ssh', used by the Famous Chollima group. The detection focuses on suspicious post-install scripts executed by node.exe, which is a known TTP for this actor to deliver malware like BeaverTail and OtterCookie.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
This analytic detects instances where web or application server processes (such as Java, Tomcat, Apache, Nginx, Node, Caddy, IIS, PHP) spawn a Linux or Windows shell. This activity is highly indicative of successful exploitation, potentially related to vulnerabilities like Log4Shell (CVE-2021-44228) or Spring4Shell (CVE-2022-22965), leading to unauthorized command execution, privilege escalation, or persistent access. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on parent-child process relationships and process names.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
Page 26 of 28