Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects malicious code injection originating from compromised npm packages into developer tools such as Microsoft VS Code, Cursor, and GitHub Desktop, or the npm CLI. This rule monitors for suspicious process command lines involving socket.io-client, ss_eval, or axios, which are characteristic of the Miasma/Socket.io backdoor campaign.
Detects the execution of script interpreters (wscript.exe, mshta.exe, cscript.exe) where the parent process, process path, or command line originates from a removable drive (drive letters D: through Z:). This is a common pattern for USB-based malware propagation and execution.
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the execution of node.exe from common user-writable or non-standard directories such as AppData, Downloads, Temp, ProgramData, or Desktop, accompanied by JavaScript file arguments. This behavior is indicative of the TonRAT campaign which uses a portable Node.js runtime to execute malicious JavaScript payloads in a stealthy manner, bypassing standard installation path detection.
Detects browser/node subprocesses spawned by AutoGen/Python processes making loopback WebSocket connections to the AutoGen Studio MCP control plane, which is indicative of the AutoJack exploit chain. This rule specifically looks for Python processes associated with 'autogen' or 'autogenstudio' that initiate network connections to loopback addresses on ports 8080 or 8081, often with specific URL paths related to the MCP WebSocket API.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
Detects the execution of rundll32.exe with command-line arguments typically used for proxy execution of scripts or malicious DLL functions (javascript:, vbscript:, ShellExec_RunDLL, LaunchINFSection), which is a common technique used by attackers to bypass security controls and execute arbitrary code, excluding instances involving comsvcs.dll.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects the Kimsuky threat group using a JSE-based loader to write decoded binary payloads to the C:\ProgramData directory. The files are written using randomized filenames with specific non-standard extensions (.a9oc, .lpXD, .lpxQ, .lpXO) initiated by wscript.exe or cscript.exe, a technique observed in their January 2026 campaign.
Detects the execution of script files (e.g., .js, .jse, .vbs) via Windows Script Host (wscript.exe, cscript.exe) where the parent or grandparent process is a known archive extraction utility (e.g., 7zip, WinRAR). The rule further filters by identifying keywords associated with malicious lures (e.g., 'health', 'medical', 'nhis'). This behavior is commonly associated with phishing campaigns delivering malicious attachments.
This rule detects potentially malicious reconnaissance and execution activity. On Linux, it monitors for network and system information discovery utilities (e.g., ifconfig, netstat, ip) executed by shells or remote access daemons. On Windows, it monitors for the use of WScript, CScript, WMIC, and WBEMTest in potentially suspicious ways, including the use of WMI for command execution.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
Detects Node.js processes launched via command line with potentially obfuscated or malicious code patterns. This includes the use of eval-like flags combined with JavaScript memory management or network-related library imports, as well as command lines containing unusually long hex-encoded strings or base64-encoded blocks often used by attackers to hide payloads.
Page 16 of 34