Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Description: Detects the Stage 2 C2 tasking loop from the malicious Next.js developer-targeting campaign.Stage 2 spawns a child Node.js process and executes attacker-supplied JavaScript via STDIN ('-') or eval ('-e'), sourced from a parent Node process that previously beaconed to Vercel staging infrastructure. Trojanized assets involved include jquery.min.js and env-setup.js loaded from
known malicious repo structures.
known malicious repo structures.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
Detects portable Node.js binaries executing from C:\ProgramData, which can be indicative of malware like Lorem Ipsum or EtherRAT. This rule specifically looks for 'node.exe' processes running from the 'C:\ProgramData\' directory with a command line containing '.js'.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects the execution of 'node.exe' with 'Update.js' in its command line. This pattern is associated with the primary dropper for the 'Lorem Ipsum' malware.
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Page 24 of 28