Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects IronWorm rootkit activity on Linux, specifically focusing on cases where npm or node processes spawn tools like bpftool, insmod, or modprobe to load eBPF programs or kernel modules. It also flags the usage of specific IronWorm-associated filenames (q2.bpf, libbpf) within directories managed by npm or node.
Detects instances where a node or node.exe process accesses common shell history files (such as .bash_history, .zsh_history, etc.). This behavior is often associated with unauthorized access to command history, which may contain sensitive information like credentials or configuration details.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.
Detects node.exe processes accessing sensitive AWS configuration files (credentials, config), .npmrc files, or suspicious data parsing utilities, indicative of the Polymarket Trap npm infostealer attempting to exfiltrate cloud credentials and tokens from developer workstations.
Detects instances where a Node.js process (e.g., node.exe) spawns standard system reconnaissance binaries such as whoami, hostname, systeminfo, ipconfig, or ifconfig. This behavior is indicative of malicious activity, specifically infostealer campaigns (like the Polymarket Trap / Miasma) that leverage npm postinstall scripts or other Node.js execution patterns to gather host and environment information from developer machines.
Detects node.exe (Node.js runtime) process initiating file read operations on sensitive files such as SSH keys, AWS credentials, Docker configuration files, GPG keyrings, or package manager configuration files (npmrc/pypirc). This behavior is characteristic of malicious npm packages or infostealers attempting to exfiltrate developer credentials, as observed in the Polymarket Trap supply chain campaign.
Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects instances where a Python process is spawned by npm or node and subsequently attempts to access sensitive browser or cloud credential files. This pattern is characteristic of malicious npm packages used for credential theft.
Detects Node.js processes launched via command line with potentially obfuscated or malicious code patterns. This includes the use of eval-like flags combined with JavaScript memory management or network-related library imports, as well as command lines containing unusually long hex-encoded strings or base64-encoded blocks often used by attackers to hide payloads.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Page 17 of 28