Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
587 detections
Filters
Last updated
All Time
Detection languages
194
76
64
61
61
Contributors
280
82
38
38
34
Categories
362
259
186
92
78
Platforms
489
459
342
11
5
Products / Services
10,680
9,761
6,694
4,418
3,744
587
MITRE Techniques
322
193
158
144
93
CVEs
7
4
3
3
2
IDS Classtypes
4
IDS Protocols
4
Detects a Node.js web server process initiating a child process that is a known command shell or download utility, which is indicative of post-exploitation activity such as remote code execution.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects HTTP requests carrying a Brotli Content-Encoding request body, which serves as the delivery vector for Node2Shell (CVE-2026-111497), an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js and Bun.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Detects a Node.js or Bun process spawning a shell or common download utility on Linux, indicating potential post-exploitation activity such as remote code execution (e.g., CVE-2026-111497).
Detects Linux process creation where a Node.js or Bun runtime spawns a shell or download utility as an anomalous child process (post-exploitation of the Brotli decoder out-of-bounds write, CVE-2026-111497), or where the Node2Shell PoC python script is run.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects execution of a Python proof-of-concept script targeting CVE-2026-111497 that launches node child processes or runs related commands involving Brotli compression files and decompression functions.
Detects runtime processes associated with AI agents or scripting environments (e.g., python, node, deno) accessing sensitive credential storage paths and files, such as SSH keys, cloud provider configuration directories, and local environment variables, which may indicate credential exfiltration.
Detects suspicious npm preinstall activity or node_modules execution patterns involving the execution of the Bun JavaScript runtime. This behavior is often indicative of supply chain compromise where malicious npm packages attempt to drop and run unauthorized binaries to facilitate secondary payload execution.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects instances where AI agent runtime environments, such as Python or Node.js processes, spawn command interpreters to execute commands that suggest reconnaissance or unauthorized system manipulation. This behavior is indicative of a hijacked AI agent abusing its tool-use capabilities to execute commands outside of an approved workflow.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
This rule detects potentially malicious command execution patterns in Linux environments, specifically targeting Node.js processes performing in-memory evaluation of code (often associated with fileless loaders) or the downloading of files with the .enc extension using common utilities like curl or wget, which may indicate C2 payload retrieval.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Detects unauthorized file deletion activity performed directly by a Node.js process acting as a ChainScript RAT. The RAT uses a bundled node.exe process, operating within specific masquerading directories in the user profile, to execute file system operations such as recursive deletion without spawning child processes.
Detects web application server processes (such as IIS, Apache, Tomcat, Java, Nginx, or Node.js) spawning command-line interpreters or system utilities. This behavior is frequently associated with webshell execution or post-exploitation activities following the exploitation of a public-facing application, often seen in VPN or enterprise software compromises.
Page 1 of 28