Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
Detects instances where AI coding agents, specifically Claude or Node-based environments, initiate secondary processes like git clone, package installation (pip, npm), or script execution. This behavior often suggests the agent is autonomously pulling and executing code from external repositories without explicit human approval, posing a significant risk of supply chain compromise.
Detects the execution of known malicious or hijacked npm and Go packages associated with the Lazarus Group 'Contagious Interview' supply chain campaign. The rule monitors for node.exe or go.exe spawning unexpected child processes like shells or download utilities (e.g., curl, powershell) and the presence of specific malicious package names in command lines.
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
Detects the execution of a malicious Node.js payload by the TONResolver malware. The rule monitors for the execution of node.exe from a specific path within the user's AppData directory (AppData\Local\Nodejs\node-v24.13.0-win-x64\) when accompanied by a JavaScript file argument, indicating the execution of a remote access trojan (RAT) script.
Detects the spawning of a Python interpreter process by npm or node.js parent processes where the Python command line involves directories typically used for temporary files or staging (e.g., AppData, Temp). This behavior is consistent with the execution of the InvisibleFerret multi-stage backdoor, often delivered via malicious packages in developer environments.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects Node.js, NPM, or NPX processes attempting to read sensitive shell history files (e.g., .bash_history, .zsh_history). This behavior is characteristic of malicious activity such as infostealers attempting to harvest credentials or reconnaissance data from a compromised developer environment, notably observed in supply chain campaigns like the Polymarket Trap.
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Page 12 of 28