Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Node.js processes accessing sensitive configuration files such as .npmrc (npm authentication tokens) or .docker/config.json (docker registry credentials). This rule filters for activity within npm lifecycle script contexts (e.g., preinstall, postinstall hooks), which is a common technique used in software supply chain attacks to exfiltrate credentials.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
Detects node.js processes accessing sensitive configuration files, SSH keys, browser login databases, and other credential stores. This activity is indicative of malicious transitive dependencies within the npm ecosystem attempting to exfiltrate credentials during module initialization, even when top-level install scripts are restricted.
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.
Detects unauthorized access to SSH private key files by processes spawned directly or indirectly from npm lifecycle hooks (e.g., postinstall, preinstall). This behavioral pattern is associated with supply chain attacks such as the Miasma infostealer, where malicious dependencies attempt to exfiltrate credentials during the installation phase.
Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.
Detects node.js processes spawned from npm postinstall hooks accessing developer credential files including .gitconfig, .npmrc, and GitHub CLI token files, consistent with the Operation Friday Harvest infostealer campaign targeting Claude Code, GitHub CLI, and npm tokens via malicious npm packages.
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Detects the execution of Node.js processes initiated by or related to the Flowise low-code AI platform, specifically where the --require flag is used. This pattern may indicate the loading of arbitrary JavaScript code or modules into the Node.js runtime, which could be indicative of malicious code injection or exploit activity within the Flowise environment.
Detects instances where Node.js or Code.exe (e.g., VS Code integrated terminals) spawns child processes executing suspicious JavaScript files or command-line arguments indicative of web-based exploitation or lateral movement, such as 'jsonwebauth', 'lserver.js', or 'errorHandler.js'.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
This rule monitors for suspicious activity associated with Flowise Model Context Protocol (MCP) implementations, specifically detecting environment variable bypasses using Node.js --require, potential Server-Side Request Forgery (SSRF) attempts targeting internal infrastructure and cloud metadata services, and the creation of known proof-of-concept (PoC) artifacts.
This rule detects a scenario where an AI agent (Python or Node.js based) reads a corporate document (PDF, DOCX, TXT, MD) and subsequently spawns a command shell (cmd.exe, powershell.exe, sh, bash) within a 30-second window. This behavior indicates a potential indirect Remote Code Execution (RCE) where a prompt-injected payload from a poisoned document was executed by the AI agent.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Page 22 of 28