Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Page 960 of 1168