Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Node.js orchestrating the SentinelOne memory scanner for evasion and targeted DLL sideloading. This behavior is indicative of an adversary attempting to use legitimate tools in an unexpected way, potentially to bypass security controls or perform malicious actions under the guise of a trusted process.
Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects Node.js initiating connections over port 2222. This is used by the Miasma botnet as a fallback C2/SSH channel when standard ports are blocked.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects the execution of Python or Node.js processes that include command-line arguments indicative of base64 decoding or zlib decompression, often used for deobfuscating and executing malicious payloads in memory.
Identifies Node.js initiating exfiltration connections to the C2 with parameters indicating disabled TLS certificate validation.
Detects the modification of Windows Registry run keys by node.exe. This activity is often used by adversaries to establish persistence, where a malicious Node.js script or application is set to automatically execute upon user logon.
Detects the execution of Node.js build processes (node-gyp) or npm build commands involving native module compilation. These patterns are often indicative of legitimate development workflows but are also leveraged by attackers to compile malicious native add-ons or execute arbitrary code in a build environment.
This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Page 23 of 28