Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
300 detections
Filters
Last updated
All Time
Detection languages
189
26
21
20
17
Contributors
60
58
57
14
12
Categories
96
95
58
43
40
Platforms
197
129
92
28
17
Products / Services
86
31
30
29
24
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
1
1
IDS Classtypes
1
1
1
1
IDS Protocols
1
1
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
This rule detects suspicious activity related to package managers (nuget, dotnet) where an attempt is made to install or restore packages that are explicitly not marked as 'official' or 'trusted' and contain keywords like '-modified', '-patched', or '-update' in their URL. This could indicate an attempt to inject malicious or tampered dependencies into a project, a common technique in supply chain attacks. The rule triggers if two or more such events occur within an hour on the same computer by the same user.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
Detects endpoint connections to infrastructure utilized by SmartApeSG after compromising the Okendo Reviews widget. Specifically, this rule looks for network connections to the domains 'api.wigetticks.com' and 'api.wizzleticks.com', which have been associated with the SmartApeSG supply chain attack targeting the Okendo Reviews widget.
This rule detects misconfigurations in GitHub Actions workflows related to Claude automation. Specifically, it looks for workflow files (.yml or .yaml) within the '.github/workflows' directory where the initiating process command line contains 'allowed_non_write_users' or 'claude-code-action' along with a wildcard ('*') in the user permissions. Such a configuration could allow unauthorized users to trigger code changes via AI actions on a repository, indicating a potential security vulnerability.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".
Detects a game updater overwriting an established executable in the platform directory with a new binary from a temporary staging path. This behavior can be indicative of a supply chain attack where legitimate game update mechanisms are compromised to deliver malicious payloads.
Detects downloads of typosquatted packages from npm or PyPI
Detects downloads of typosquatted packages from npm or PyPI
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
This rule detects network connections to subdomains of 'generate.2faplugin.org' using a regular expression. This infrastructure is associated with a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins were distributed via official channels. The regex is designed to catch varying subdomains related to this malicious infrastructure.
Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
This rule detects suspicious activity related to package managers (nuget, dotnet) where an attempt is made to install or restore packages that are explicitly not marked as 'official' or 'trusted' and contain keywords like '-modified', '-patched', or '-update' in their URL. This could indicate an attempt to inject malicious or tampered dependencies into a project, a common technique in supply chain attacks. The rule triggers if two or more such events occur within an hour on the same computer by the same user.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Page 10 of 15