Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects instances of npm package publication events initiated by known-compromised maintainer accounts (czirker, llxlr). These accounts have been identified as being used to distribute malicious packages, such as leo-aws versions, representing a software supply chain compromise.
Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.
Detects execution of node-gyp to compile native Node.js addons, which can be leveraged by attackers to execute arbitrary code or build malicious modules during project installation or development. The rule looks for binding.gyp usage and build commands initiated by npm or node processes.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.
Detects node.js executing known malicious npm lifecycle scripts (such as install-check.cjs, verify-peer.cjs, sync-peer.cjs, postinstall-run.js, and preinstall.js) often found in node_modules folders. These scripts are associated with the Polymarket Trap supply chain campaign, which leverages malicious npm hooks for initial access or malicious activity within a development environment.
Detects the execution of Node.js or npm processes that reference known malicious transitive npm dependencies or typosquatted packages identified in the Polymarket Trap supply chain campaign, such as 'log-taker' and various 'thirdweb' typosquats.
Detects the Polymarket Trap / Miasma JavaScript-based infostealer attempting to access sensitive configuration files and credentials (SSH keys, AWS credentials, .npmrc, .pypirc, Docker config, and GPG keys) from a developer's workstation using node.js-related runtimes.
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Page 21 of 28