Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects indicators of the June 2026 Mastra npm supply chain attack, in which
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
Correlates the drop of a 24-character hex .js file with its immediate execution by node.exe, indicating potential compromise via a supply chain attack like Mastra NPM.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects malicious script injection into HTTP responses via MitM
This rule finds Bun extracted to a temporary folder during npm install on a machine that does not normally use Bun. Temp paths hide binaries from casual inspection. Remove the package and scan the host. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
This rule connects the creation of the 'Edgre' persistence registry key, which contains 'zuidrt.hta', to the actual process execution of 'zuidrt.hta'. This activity is associated with Operation XENOFISCAL, where the SideCopy threat group deploys the XenorRAT malware.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
Detects malicious script injection into HTTP responses via MitM
Detects the creation of a potentially malicious 'index.js' file within a suspicious application data folder, specifically targeting the 'SuperMaxionQuickMaxlite' directory. This pattern is often associated with Electron-based malware or modified legitimate applications.
Detects the execution of VBScript or JScript files (via wscript.exe or cscript.exe) where the command line contains common VBScript argument handling keywords. This pattern can indicate malicious script execution attempting to parse arguments for further actions, potentially as part of a phishing attack or malware execution chain.
Detects injection of malicious scripts into legitimate websites for watering hole attacks
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects Node.js executing the 'utils.cjs' script, which serves as the obfuscated malware dropper for a North Korean-linked infostealer campaign. This script is typically triggered by a malicious npm postinstall hook to download the second-stage payload.
Identifies the creation or execution of the specific JavaScript file named 'Remittance Advice.js' used in the initial access phase of the Evil MSI Background steganography campaign.
Page 23 of 34