Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects a Node or Bun process writing to Claude Code or VS Code autostart configuration. The
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
Detects instances where VS Code (Code.exe) or Node.js (node.exe) processes reference CI/CD-related environment variables in their command line. This behavior is often associated with build pipeline manipulation, credential harvesting from environment configurations, or post-exploitation activities within developer environments.
Detects VS Code / Node.js extension host processes invoking command lines that reference CI/CD and repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite, CircleCI, Codespace, Gitpod), consistent with malicious Open VSX "evil twin" extensions harvesting developer and CI/CD metadata.
Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.
Detects the ChainDrop/Shai-Hulud 2.0 "Run Copilot" secrets-laundering technique: a CI workflow step dumping toJSON(secrets) to a format-results.txt artifact, followed by GitHub Actions artifact-API downloads using scraped ghs_ runner tokens and git ref deletion used to cover tracks.
Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects the execution of the 'clientCode' RAT process when initiated by a Node.js process (node.exe/node). This behavior is indicative of a second-stage payload execution related to supply chain compromises where malicious dependencies are leveraged to gain remote shell access.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
Detects unauthorized modifications to the core npm CLI entry point file (cli.js). Adversaries may modify this file to inject malicious code, achieving persistence or executing unauthorized commands whenever the npm tool is invoked.
Detects indicators of the Miasma worm compromise on Windows and macOS systems. This includes the execution of malicious Spectral CLI payloads from npm npx cache directories, the staging and execution of sync.js payloads, the creation of Miasma-specific lock files and Cryptnet cache artifacts, and persistence established via Windows Registry Run keys.
Detects the execution of the Stoplight Spectral CLI tool from within the temporary npm/npx cache directory structure on Windows endpoints. This behavior is associated with supply-chain attacks, where malicious packages exploit npx cache paths to execute unauthorized code. The rule accounts for both fixed cache identifiers observed in specific campaigns and generalized paths used by npx, while excluding benign Playwright test executions.
Detects Node.js processes spawning child Node.js processes where the command line references known IPFS gateways, the 'sync.js' script name, or specific Content Identifiers (CIDs) associated with Miasma malware or related decentralized distribution activity.
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Detects the installation or referencing of the malicious @injectivelabs/sdk-ts package version 1.20.21. This specific version was identified as containing a credential-stealing backdoor disguised within telemetry code.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
This rule detects the execution of 'node.exe' or 'node' processes that involve specific JavaScript files ('dist/setup.js' or 'dist/intro.js') within the command line arguments or file paths. Such patterns are indicative of potential malicious activity, often associated with the deployment of unauthorized scripts or secondary payloads in a node.js environment.
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
Detects a Node.js process spawning a detached child process that executes a script named 'caller.js'. This behavior is consistent with the 'nodemon-sudo' or 'tslint-conf' supply chain attacks, which leverage detached child processes to execute malicious second-stage payloads while suppressing console output, effectively creating a persistent, hidden backdoor.
Page 10 of 28