Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,665
9,773
6,705
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects malicious node.exe processes engaging in system, user, process, or network discovery behaviors. This behavior is indicative of malicious npm packages, such as those seen in the Polymarket Trap, Miasma, or MYRA campaigns, which perform reconnaissance before attempting credential exfiltration.
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
This rule detects when a Node.js process accesses sensitive files associated with cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet) or browser extension storage directories. This behavior is highly indicative of information-stealing malware attempting to extract private keys, wallet configuration files, or sensitive browser session data.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects a multi-stage infection chain associated with the TONResolver campaign where PowerShell is used to execute a Node.js-based RAT payload from a non-standard location in AppData\Local\Nodejs. This pattern monitors for the parent-child relationship where PowerShell launches a specific node.exe instance containing JavaScript file execution flags.
Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
Detects the creation of a 'linux-process-env.json' artifact by a Node.js process. This file is typically generated by the Djinn Stealer malware as part of its 'collectLinuxProcessEnv' function, which enumerates system process command lines and environment variables from the /proc directory after initial compromise.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects a specific execution pattern where node-gyp.exe spawns node.exe to execute an 'index.js' file. This behavior is associated with the 'Miasma' or 'Mini Shai-Hulud' threat campaigns, which utilize malicious 'binding.gyp' files within npm packages to bypass standard lifecycle script (preinstall/postinstall) security scanners.
Detects a suspicious execution chain where 'node-gyp' is observed spawning 'node' to execute 'index.js', characteristic of a 'Phantom Gyp' malicious pattern, followed immediately by the execution of a temporary JavaScript payload via the 'bun' runtime. This pattern is indicative of a multi-stage loader often used in supply chain attacks involving obfuscated payloads.
Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Page 18 of 28