Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
737 detections
Filters
Last updated
All Time
Detection languages
363
124
60
58
36
Contributors
222
123
75
46
32
Categories
336
254
143
140
102
Platforms
526
385
292
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
737
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
This rule detects the download of potentially trojanized software updates. It specifically looks for HTTP traffic flowing to the client, where the URI contains "update" (case-insensitive), the HTTP host contains "update.", "cdn.", or "download." (case-insensitive), and the file data starts with "MZ" (indicating a Windows executable) within the first 2 bytes. Additionally, the downloaded file size must be greater than 500,000 bytes.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects command line activity indicating the installation of packages from the compromised @redhat-cloud-services npm scope, which was leveraged in a supply chain attack to drop the Miasma/Shai-Hulud infostealer malware.
This query identifies devices and users where the compromised Nx Console VS Code extension version 18.95.0 was observed in the local VS Code extensions directory or referenced in process command-line activity. The detection focuses only on the affected version: nrwl.angular-console-18.95.0. This query combines two evidence sources: DeviceFileEvents (confirms file or folder activity related to the extension path) and DeviceProcessEvents (confirms execution or command-line reference involving the extension).
Identifies processes launched with the __DAEMONIZED=1 environment variable. This specific marker is used by the vpmdhaj malicious npm packages to spawn their stage-2 credential harvesting payload as a detached process, allowing it to survive parent termination.
This rule detects the execution of 'vsce-sign.exe' with command-line arguments indicating the verification of cached VS Code extensions. This activity is part of the normal VS Code extension installation and update process, where extensions are verified for integrity and authenticity. While this is a legitimate process, monitoring it can be useful for identifying anomalies or potential supply chain compromises if unexpected extensions are being verified or if the verification process itself is being abused.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
KQL Query
KQL Query
Identifies the creation of a stage-2 binary named 'payload.bin' within a 'node_modules' directory. This artifact is dropped by the Gen-1 stager used in the vpmdhaj malicious npm campaign, which targets cloud and CI/CD credentials.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Detects when an application is published or updated in the Microsoft Teams app catalog. This activity could indicate malicious app deployment, supply chain tampering via catalog abuse, or unauthorized application changes.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
A large-scale supply-chain attack where 84 compromised npm package artifacts in the tanstack namespace were modified with credential-stealing malware. The incident is tracked as part of the ongoing Mini Shai-Hulud campaign.
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
Page 28 of 36