Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,665
9,773
6,705
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects potential exploitation attempts targeting the Flowise 3.1.2 Custom MCP (Model Context Protocol) stdio interface. The detection monitors for the bypass of environment variable validation where lowercase 'node_options' is used to circumvent security controls blocking 'NODE_OPTIONS', potentially allowing unauthorized code execution via '--require'. It also alerts on the presence of associated PoC artifacts and anomalous outbound network activity from Flowise processes.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Detects the execution of PowerShell or Bash commands, potentially for implant delivery, spawned from Visual Studio Code extension host processes (node.exe, code.exe, code-server, cursor). This rule specifically looks for command-line patterns associated with the GLASSWORM.WASM threat, such as 'irm', 'iex', 'curl -fsSL', 'Invoke-Expression', 'IEX', or combinations of 'powershell -Command', 'curl -fsSL', and 'bash -c'.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects the execution of non-JavaScript ELF binaries (e.g., Rust-compiled binaries) from within npm package directories or specific setup paths, typically during 'preinstall' or 'postinstall' npm lifecycle hooks. This behavior is indicative of potential supply-chain attacks where malicious code is executed during dependency installation.
Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.
Page 16 of 28