Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,597 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects the installation, service creation, registry modification, and network activity associated with the Tailscale VPN tool. This rule monitors for persistent use of Tailscale, which can be utilized by threat actors to establish encrypted mesh access to internal environments.
Detects instances where a node.exe process accesses files located within directories associated with popular browser-based cryptocurrency wallets. This pattern is commonly observed in infostealer malware campaigns that target wallet seeds, keys, and browser credentials stored in extension local storage or browser profile paths.
Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects instances where a Node.js process (e.g., node.exe) spawns standard system reconnaissance binaries such as whoami, hostname, systeminfo, ipconfig, or ifconfig. This behavior is indicative of malicious activity, specifically infostealer campaigns (like the Polymarket Trap / Miasma) that leverage npm postinstall scripts or other Node.js execution patterns to gather host and environment information from developer machines.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
Detects the creation of a Windows scheduled task using 'schtasks.exe' with the 'Highest' run level, configured to execute either 'powershell.exe' or 'wscript.exe'. This pattern is consistent with persistence mechanisms observed in Operation Poisson, where attackers establish elevated, automated execution of scripts.
Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.
Page 803 of 1168