Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects instances where a Node.js process spawns another Node.js process to execute a JavaScript file located within the node_modules directory. This pattern is commonly observed when malware or malicious scripts attempt to execute payloads from within project dependencies, potentially hiding malicious activity within seemingly legitimate library paths.
This rule detects instances where a Node.js process spawns a child process, also running as node.exe, that attempts to execute a specific JavaScript file path (sharedLoad.min.js or its extended version). This behavior is characteristic of certain Node.js-based applications or potentially malicious scripts using shared loaders for modular execution.
Detects npm package publish events that lack 'gitHead' provenance metadata. The absence of this field indicates that the package was likely published from a developer's local machine rather than through an authorized CI/CD pipeline, a technique used in supply chain attacks to bypass CI-gated controls.
Detects instances where Node.js, Python, or Go processes spawn command shell interpreters (cmd.exe, powershell.exe, etc.). This behavior is often indicative of C2 command execution by malware, such as the Graphalgo RAT, which may use these languages to execute shell-level commands after initial infection or payload execution.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects Node.js processes, such as npm package postinstall hooks, spawning shell commands used for host enumeration. This includes accessing system environment variables, network configurations, and filesystem metadata, a pattern frequently utilized by malicious packages for initial reconnaissance post-installation.
This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.
This rule detects potentially malicious modifications to package.json files in npm projects or suspicious npm registry telemetry. It flags manifest files containing common obfuscation markers or excessive/unusual dependencies often associated with supply chain attacks, such as crypto, child_process, and common third-party packages frequently used in malicious npm activity.
Detects instances where the Node.js runtime environment (node.exe) deletes a file named 'sharedLoad.min.js' located within a 'node_modules' directory. This behavior is indicative of anti-forensic cleanup activities where malicious npm packages attempt to remove their own footprints or temporary artifacts post-execution.
Detects the execution and behavioral patterns associated with the malicious 'indexed-btree' npm package. The rule specifically looks for code patterns where a malicious loader is injected into 'BTree.prototype.set' and triggered at runtime. It also monitors for suspicious process spawning behavior, such as running node processes with detached and hidden windows flags, often used by the package to maintain persistence or execute malicious payloads silently.
Detects the installation of specific known malicious NPM packages (indexed-btree, btree-core, mutex-forge) or execution of npm install commands targeting these packages, which are indicative of software supply chain compromise attempts.
Detects instances where a Node.js process (node.exe) attempts to execute native system discovery commands such as systeminfo, hostname, or wmic queries. This pattern is commonly observed in malicious Node.js applications or compromised environments attempting to gather system reconnaissance information.
This rule detects when the Node.js runtime process (node.exe) initiates the Windows command interpreter (cmd.exe) with the '/c' flag, which is commonly used to execute commands or scripts. This behavior is frequently associated with malicious Node.js activity, such as Remote Access Trojans (RATs) or web shells, which may use the shell to execute system-level operations or bypass typical application constraints.
ChainScript file manager 'files' task: node.exe performing high-volume recursive deletion within masqueraded ChainScript installation paths (drive enumeration, dir listing, file read/write, recursive delete)
This rule detects suspicious PowerShell execution initiated by a Node.js process (node.exe). It monitors for command lines containing common bypass flags (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) and a specific string pattern 'wra-ps-', which is often associated with malicious scripts or remote access trojans (RATs) being executed via a Node.js application.
Detects process execution patterns and DNS requests associated with the GHAPPIER malware staging infrastructure. The rule monitors for specific command-line arguments involving known malicious scripts, temporary files, and deployment infrastructure (e.g., Vercel) often used for delivering or executing malicious payloads via node.js environments.
This rule detects the GHAPPIER multi-stage loader, typically observed in 'indexe.cjs' files. The loader fetches and executes a remote payload from a Vercel-hosted domain (primevector-app924560.vercel.app) using 'eval' on retrieved content, or matches specific payload identification tags.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects instances where npm processes (install, preinstall, or postinstall) spawn suspicious child processes such as shell interpreters (cmd, powershell, bash, sh), network utilities (curl, wget), or scripting interpreters (python). This behavior is often associated with malicious npm package installation or software supply chain compromise where post-install scripts are used to gain persistence or download secondary payloads.
Detects Node.js processes executing system-level reconnaissance (e.g., CPU, memory, hostname, uptime enumeration) followed by network connections to known exfiltration endpoints (Slack, Telegram API). This behavior aligns with identified npm malware campaigns using host fingerprinting for target selection and data exfiltration.
Page 3 of 28