Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
582 detections
Filters
Last updated
All Time
Detection languages
192
73
64
61
61
Contributors
280
82
38
38
34
Categories
358
256
185
92
78
Platforms
486
454
340
11
5
Products / Services
10,670
9,758
6,693
4,421
3,749
582
MITRE Techniques
318
192
158
141
93
CVEs
4
3
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects the presence of a hardcoded X25519 public key associated with the 'indexed-btree' npm malware loader. This loader uses the key for ECDH key derivation to decrypt secondary payloads retrieved from an Ethereum smart contract, a technique used by malicious packages to hide their functionality.
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects npm packages exhibiting suspicious metadata characteristics, such as disproportionately high download counts relative to package age, or combinations of trust signals that suggest potential supply chain poisoning or typosquatting, specifically targeting packages mimicking legitimate sorted-btree functionality.
This rule monitors for suspicious Node.js process activity, specifically focusing on the loading of scripts associated with obfuscated or malicious packages (e.g., sharedLoad.min.js, indexed-btree) and the use of child_process spawn patterns that indicate detached, hidden, or unreferenced child processes, which are common tactics for bypassing detection or maintaining stealthy execution.
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects the sharedLoad.min.js obfuscated first-stage loader dropped by the malicious npm indexed-btree package, triggered via BTree.prototype.set to evade static/taint-analysis scanners
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
This rule detects the execution of npm or node.js commands involving specific, potentially malicious package names or internal project naming patterns often associated with dependency confusion or supply chain attacks. It monitors npm/node CLI arguments for targeted library names or installation commands that deviate from standard organizational behavior.
Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.
Detects a Node.js process executing a JavaScript file that spawns a secondary Node.js child process, followed immediately by the creation or modification of Windows Run registry keys for persistence. This sequence is indicative of malicious npm package activity where a secondary, hidden payload is downloaded and configured to execute upon system startup.
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Page 6 of 28