Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects file creation events related to known GLASSWORM VS Code extension files or WebAssembly (WASM) loader JavaScript shims. It also identifies process execution where the VS Code extension host spawns 'node.exe' with known GLASSWORM JavaScript shims. This rule aims to identify the presence and execution of the GLASSWORM malware.
Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).
Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
Detects JavaScript using the 'ghost_once_footer_' key with localStorage read and write operations, indicative of potential web-based attacks leveraging compromised Ghost CMS instances. This rule specifically looks for the string 'ghost_once_footer_' in conjunction with 'localStorage.getItem' and 'localStorage.setItem', suggesting a mechanism for persistent or one-time data storage in the browser's local storage.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
Detects the execution of mshta.exe followed by the execution of a .dat file, consistent with the Turla STOCKSTAY campaign. The rule monitors for mshta.exe spawning suspicious processes or executing payloads masquerading as data files (e.g., styles.dat) to achieve malicious functionality.
Detects a potential Remote Code Execution (RCE) chain originating from AI orchestration frameworks (such as AutoGen/Uvicorn). The rule identifies an execution flow where an AI framework launches a browser automation process (e.g., Playwright/Chromium), which subsequently spawns a suspicious OS shell or LOLBin (Living-off-the-Land Binary) that immediately initiates an external network connection. This behavior is indicative of an AI agent being coerced to bypass security controls via MCP (Model Context Protocol) WebSocket loopback trust, leading to command execution and external C2 communication.
Detects evidence of the NodeBB ActivityPub UID spoofing proof-of-concept (PoC) script (poc.js). The rule identifies the execution of node processes using specific command-line arguments (--target-base, --actor-origin, --spoof-uid, --recipient-uid) associated with the exploit, as well as Node.js processes making outbound network connections to ActivityPub path components (/inbox, /activitypub) over non-standard network ports. This activity is indicative of vulnerability testing or exploitation attempts.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
Detects the execution of script interpreters (mshta, wscript, cscript) or PowerShell initiated by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This pattern is a common indicator of malicious macro or embedded script execution, often used to deliver secondary payloads.
This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
Page 18 of 34