Every published rule

macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

Flags macOS command-line patterns showing osascript execution plus npm package download and staged file cleanup.

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.

Windows Process Creation: npm install for Shai-Hulud 2.0 Malicious Package Names and Versions

Alert on Windows node.exe running npm install with command-line package/version strings known from the Shai-Hulud 2.0 npm campaign.

Linux Process Creation: npm install of Shai-Hulud 2.0 malicious packages by name and version

Alerts on Linux npm install commands referencing known Shai-Hulud 2.0 malicious package versions.

Windows AppX/MSIX Full Trust Package Installation via AppXDeployment-Server

Flags AppX/MSIX installs with Full Trust on Windows, reducing noise by excluding common Microsoft and Program Files sources.

Windows: Successful MSIX/AppX Package Installation via AppX Deployment Server (Event ID 854)

Flags successful MSIX/AppX package installations on Windows using EventID 854 from the AppXDeployment-Server operational log.

Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Alerts on Linux curl command lines using -d to send data to a specific webhook.site endpoint, consistent with exfiltration.

Windows: .pth Python Path Configuration File Created in site-packages or venv

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.

macOS Python Site-Packages .pth File Creation

Alerts on new .pth files created under macOS Python site-packages, a mechanism that can execute code at Python startup.

Linux: Detect Python .pth Path Configuration File Creation in site-packages

Alerts on creation of Python .pth files in /lib/python3.X/site-packages on Linux, which can trigger code at Python startup.

Windows iexpress.exe Creates Self-Extracting Binaries Using SED Files From Suspicious Paths

Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.

Windows: Alerts on Creation of .sed Self-Extraction Directive File

Flags creation of newly created .sed directive files on Windows, which can be used for self-extracting package abuse.

Windows Process Creation: IExpress.exe Creating Self-Extracting Packages

Identifies IExpress.exe usage to generate self-extracting packages, including makecab.exe involvement and IExpress command-line patterns.

Windows Process: winget adds new download source via 'source add' with IP/endpoint

Alerts on winget.exe being used to add a new package download source specified by an IP address.

Windows Winget adds HTTP package source

Alerts when winget is used to add a package source pointing to an http:// URL.

Windows: winget.exe adds new download sources via 'source add'

Alerts on winget.exe usage to add new package download sources using 'source add'.

Linux Package Removal via yum, apt, dpkg, or rpm Commands

Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.

Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation

Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.

Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation

Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.

Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate

Alerts when AppX package execution/signature subject matches a known suspicious certificate in Windows telemetry.