Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the creation or modification of suspicious LaunchAgent or LaunchDaemon plist files on macOS. Specifically looks for files named 'com.apple.accountsd.plist' or files within a hidden directory '.com.apple.accountsd' in common LaunchAgent/Daemon paths. This pattern is often used by malware for persistence.
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
Clipboard hijacking malware for cryptocurrency address substitution
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.
Detects processes that access a threshold of five or more sensitive configuration, credential, or browser-stored login files within a single execution context, which is indicative of credential harvesting or automated collection activity.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects unauthorized access to sensitive developer credential files and browser credential stores, typical of the IronWorm Rust-based infostealer. The rule monitors processes that are not known developer or browser tools as they read paths associated with AWS, SSH, Kubernetes, Docker, browser login data, and cryptocurrency wallets.
Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.
Detects instances where a node or node.exe process accesses common shell history files (such as .bash_history, .zsh_history, etc.). This behavior is often associated with unauthorized access to command history, which may contain sensitive information like credentials or configuration details.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
Detects Node.js processes accessing common shell history files or PowerShell history logs. This behavior is indicative of infostealer malware, such as those targeting developers, attempting to extract credentials or command history from the local filesystem.
Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Page 109 of 174