Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,680
9,759
6,693
4,421
3,750
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
This rule monitors for potential Server-Side Template Injection (SSTI) exploitation by detecting web application processes (such as Java, Python, or Web Server binaries) that initiate child processes (such as shell interpreters or script engines) while their command line contains common SSTI markers or exploitation patterns like '{{7*7}}', 'subprocess.Popen', or 'java.lang.Runtime'. This indicates an attacker has successfully escalated from template injection to remote code execution.
Detects Node.js process querying Ethereum blockchain for C2 address.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects instances where Node.js or NPM processes initiate common Windows discovery tools (e.g., systeminfo, whoami, tasklist, ipconfig, wmic). This behavior is often indicative of post-exploitation discovery or reconnaissance activity performed by an adversary utilizing an application or malicious script running within the Node.js runtime environment.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
This rule monitors for the Node.js process (node.exe or node) accessing common sensitive configuration files, SSH keys, cloud credentials, or environment files such as .ssh/id_rsa, .aws/credentials, .npmrc, and .docker/config.json. Such activity is often indicative of an adversary attempting to perform credential theft or environment discovery after gaining initial access via a compromised Node.js application.
Detects Node.js or npm processes accessing sensitive developer configuration and credential files. This rule is designed to identify malicious supply chain activity, specifically matching patterns where npm postinstall scripts or malicious node modules attempt to exfiltrate files such as .gitconfig, SSH keys, cloud credentials, and tokens from a developer workstation.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.
Detects the execution of node.exe from unusual parent processes and suspicious locations like AppData, Temp, or user-writable profile folders. This behavior is indicative of the TONResolver RAT, where node.exe is utilized to execute malicious JavaScript payloads disguised as legitimate processes.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.
Detects the use of npm to install known malicious npm packages, which is indicative of a supply chain compromise attempt via typosquatting or malicious dependency injection.
Detects evidence of the execution of a proof-of-concept (PoC) exploit targeting Next.js unstable_cache functionality. The rule monitors for the installation of canary versions of Next.js, execution of the PoC demonstration script 'run_demo.mjs', and the creation of a 'VULNERABILITY_CONFIRMED.marker' file, which are specific indicators associated with the exploitarium repository PoC.
Page 15 of 28