Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
300 detections
Filters
Last updated
All Time
Detection languages
189
26
21
20
17
Contributors
60
58
57
14
12
Categories
96
95
58
43
40
Platforms
197
129
92
28
17
Products / Services
86
31
30
29
24
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
IDS Classtypes
1
1
1
1
IDS Protocols
1
1
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
Detects network connections to known malicious infrastructure domains and IP addresses associated with the Checkmarx supply chain compromise. The compromised KICS images and mcpAddon.js payload use these hardcoded endpoints to exfiltrate stolen credentials and tokens.
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
This detection identifies the presence of ChipSoft HiX electronic health record (EHR) software within the environment. ChipSoft is the dominant EHR provider in the Netherlands (~70% market share in Dutch healthcare). On April 7, 2026, ChipSoft was hit by a ransomware attack affecting HiX on-premise, HiX SaaS, and the SaaS patient portal. Z-CERT (Dutch healthcare CERT) advised all customers to immediately disconnect VPN connections to ChipSoft and intensively monitor network traffic.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
This rule detects the execution of package managers by common parent processes when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
Detects execution of processes from node_modules which may indicate malicious package behavior
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.
This rule detects a combination of suspicious activities indicative of multi-stage malicious operations. It identifies GUP.exe beaconing to command and control (C2) servers, execution of known malicious hashes (SHA256 and SHA1), connections to C2 IP addresses and domains, suspicious filenames, DLL side-loading attempts, suspicious script/code execution, data exfiltration via curl, reconnaissance commands (whoami, tasklist, systeminfo, netstat), secondary payload writes, and initial malicious execution originating from gup.exe or temporary directories.
Detects a high volume of 'git push --force' events specifically targeting tags from a single user or to a single repository within a short timeframe.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
Detects a vulnerable GitHub Actions workflow configuration known as a "Pwn Request". This occurs when a workflow is triggered by `pull_request_target` but checks out and executes untrusted code from the head of the pull request (`${{ github.event.pull_request.head.sha }}`). This allows an attacker to run arbitrary code with the permissions of the target repository, including access to secrets. This pattern was actively exploited by the 'hackerbot-claw' campaign. This rule should be applied to files in the `.github/workflows/` directory.
Page 12 of 15