Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
This rule monitors for suspicious activity associated with npm or Node.js processes. This includes potential credential misuse during npm publish or login, unauthorized build-time execution via node-gyp, and the use of unconventional preinstall/postinstall hooks that spawn external binaries or scripts, which are often indicative of software supply chain attacks.
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects instances where a Node.js process accesses, creates, or modifies sensitive files such as SSH private keys, AWS credentials, or application configuration files (.npmrc, .pypirc, .docker/config.json). This behavior is often indicative of credential theft or unauthorized configuration access by a compromised Node.js application.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
Detects Node.js processes accessing sensitive AWS credential or configuration files. This behavior is indicative of unauthorized information gathering, often associated with infostealer malware payloads delivered via malicious npm packages.
Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects Tailscale installation, configuration, and mesh network enrollment activity. The rule monitors for the execution of Tailscale processes with enrollment flags, DNS lookups to Tailscale coordination servers, WireGuard UDP traffic on port 41641, and connections to the Tailscale CGNAT IP address space. This activity is often used by adversaries to establish persistent, encrypted remote access.
Detects Node.js or npm processes that access multiple SSH-related files within a short timeframe while also establishing external network connections, which is consistent with credential exfiltration patterns.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.
Detects Node.js processes accessing paths associated with cryptocurrency wallets and browser extension storage (MetaMask, Phantom, Exodus, Electrum). This behavior is characteristic of infostealer malware attempting to exfiltrate seed phrases, keys, or wallet configuration data.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
Page 102 of 174