Detection rules › Sigma

Sigma rules: 17

Rule	Severity
Active Directory honeypot enumerated by a suspicious host (Bloodhound)	`high`
Allow RDP Remote Assistance Feature	`medium`
AWS STS AssumeRole Misuse	`low`
CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File	`high`
EvilTokens PhaaS Kit Phishing Related Request - Proxy	`low`
Execute Code with Pester.bat	`medium`
Firewall deactivation (deprecated command)	`high`
HackTool - SafetyKatz Execution	`critical`
HackTool - Wmiexec Default Powershell Command	`high`
Invoke-Obfuscation Via Stdin - Security	`high`
macOS DNS Query Tools for C2	`medium`
macOS ULS Potential TCC Bypass Indicators	`medium`
Potential APT FIN7 POWERHOLD Execution	`high`
Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877	`high`
Potential File Extension Spoofing Using Right-to-Left Override	`high`
Potential PSFactoryBuffer COM Hijacking	`high`
PUA - NSudo Execution	`high`
Rapid creation of clients with the dynamic client registration endpoint	`medium`
Rundll32 Registered COM Objects	`high`
Security Service Disabled Via Reg.EXE	`high`
Shai-Hulud 2.0 Malicious NPM Package Installation	`high`
Sign-In From Malware Infected IP	`high`
Stickey key called CMD via command execution (hash detection)	`high`
Stickey key IFEO (Reg via command)	`high`
Suspicious modification of a sensitive Group Policy (GPO)	`medium`
Temporary Access Pass Added To An Account	`high`
Uncommon Microsoft Office Trusted Location Added	`high`
Visual Studio Code Tunnel Shell Execution	`medium`
VSS backup deletion via WMI (Powershell)	`high`

Active Directory honeypot enumerated by a suspicious host (Bloodhound)

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.

Known False Positives

LDAP explorer tools, pentest

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1087` Account Discovery

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4662: An operation was performed on an object.

Rule Body

title: Active Directory honeypot enumerated by a suspicious host (Bloodhound)
description: Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.
requirements: ensure that those accounts are "attractive", documented, do not create any breach and cannot be used against your organization. Moreover, specific SACL for "Everyone" with "ReadProperties" need to be configured on each honeypot object.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
- http://www.labofapenetrationtester.com/2018/10/deploy-deception.html
- https://jblog.javelin-networks.com/blog/the-honeypot-buster/
tags:
- attack.discovery
- attack.t1087
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectName: '%honeypot_guid_list%' # GUID of pre-configured honeypot object(s). Eg: '%{259162f1-58e4-4ee9-9b9c-2baf2a03d376}'
  condition: selection
falsepositives:
- LDAP explorer tools, pentest
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4662
  ObjectName: '%honeypot_guid_list%'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	eq	`%honeypot_guid_list%`	`field:"ObjectName" kind:eq value:"%honeypot_guid_list%"`

Allow RDP Remote Assistance Feature

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Known False Positives

Legitimate use of the feature (alerts should be investigated either way)

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule Body

title: Allow RDP Remote Assistance Feature
id: 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
status: test
description: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md
author: frack113
date: 2022-08-19
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: 'System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp'
        Details: DWORD (0x00000001)
    condition: selection
falsepositives:
    - Legitimate use of the feature (alerts should be investigated either way)
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/info.yml
simulation:
    - type: atomic-red-team
      name: Allow RDP Remote Assistance Feature
      technique: T1112
      atomic_guid: 86677d0e-0b5e-4a2b-b302-454175f9aa9e

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|endswith: 'System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp'
    Details: DWORD (0x00000001)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000001)` corpus 36 (sigma 36)	`field:"Details" kind:eq value:"DWORD (0x00000001)"`
`TargetObject`	ends_with	`System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp`	`field:"TargetObject" kind:ends_with value:"System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp"`

AWS STS AssumeRole Misuse

Status: test
Severity: low
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Known False Positives

AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Automated processes that uses Terraform may lead to false positives.

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism
Lateral Movement	`T1550.001` Use Alternate Authentication Material: Application Access Token

Rule Body

title: AWS STS AssumeRole Misuse
id: 905d389b-b853-46d0-9d3d-dea0d3a3cd49
status: test
description: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
references:
    - https://github.com/elastic/detection-rules/pull/1214
    - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
author: Austin Songer @austinsonger
date: 2021-07-24
modified: 2022-10-09
tags:
    - attack.lateral-movement
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1550
    - attack.t1550.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        userIdentity.type: AssumedRole
        userIdentity.sessionContext.sessionIssuer.type: Role
    condition: selection
falsepositives:
    - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    - Automated processes that uses Terraform may lead to false positives.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    userIdentity.type: AssumedRole
    userIdentity.sessionContext.sessionIssuer.type: Role

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`userIdentity.sessionContext.sessionIssuer.type`	eq	`Role`	`field:"userIdentity.sessionContext.sessionIssuer.type" kind:eq value:"Role"`
`userIdentity.type`	eq	`AssumedRole`	`field:"aws::userIdentity.type" kind:eq value:"AssumedRole"`

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
id: e4556676-fc5c-4e95-8c39-5ef27791541f
related:
    - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
      type: similar
status: test
description: Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331
references:
    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
    - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-30
tags:
    - attack.execution
    - cve.2023-38331
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\WinRAR.exe'
        TargetFilename|contains: '\AppData\Local\Temp\Rar$'
        TargetFilename|re: '\.[a-zA-Z0-9]{1,4} \.'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\WinRAR.exe'
    TargetFilename|contains: '\AppData\Local\Temp\Rar$'
    TargetFilename|re: '\.[a-zA-Z0-9]{1,4} \.'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\WinRAR.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\WinRAR.exe"`
`TargetFilename`	match	`\AppData\Local\Temp\Rar$`	`field:"TargetFilename" kind:match value:"\AppData\Local\Temp\Rar$"`
`TargetFilename`	regex_match	`.[a-zA-Z0-9]{1,4} .`	`field:"TargetFilename" kind:regex_match value:".[a-zA-Z0-9]{1,4} ."`

EvilTokens PhaaS Kit Phishing Related Request - Proxy

Status: experimental
Severity: low
Author: uniqu3-us3r
Source: github.com/SigmaHQ/sigma

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Known False Positives

Legitimate use of Cloudflare Workers or Railway.app domains

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link

Rule Body

title: EvilTokens PhaaS Kit Phishing Related Request - Proxy
id: e0e121d0-be4d-4281-af7e-17abbba4a408
status: experimental
description: |
    Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure.
    Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks.
    This indicates a user has clicked a phishing link.
references:
    - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
author: uniqu3-us3r
date: 2026-04-28
tags:
    - attack.initial-access
    - attack.t1566.002
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'
    condition: selection
falsepositives:
    - Legitimate use of Cloudflare Workers or Railway.app domains
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	regex_match	`-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev` `.up.railway.app`	`field:"c-uri" kind:regex_match`

Execute Code with Pester.bat

Status: test
Severity: medium
Author: Julia Fomina, oscd.community
Source: github.com/SigmaHQ/sigma

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Known False Positives

Legitimate use of Pester for writing tests for Powershell scripts and modules

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Stealth	`T1216` System Script Proxy Execution

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Execute Code with Pester.bat
id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
status: test
description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
references:
    - https://twitter.com/Oddvarmoe/status/993383596244258816
    - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
author: Julia Fomina, oscd.community
date: 2020-10-08
modified: 2023-11-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1216
logsource:
    category: process_creation
    product: windows
detection:
    powershell_module:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Pester'
            - 'Get-Help'
    cmd_execution:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'pester'
            - ';'
    get_help:
        CommandLine|contains:
            - 'help'
            - '\?'
    condition: powershell_module or (cmd_execution and get_help)
falsepositives:
    - Legitimate use of Pester for writing tests for Powershell scripts and modules
level: medium

Stages and Predicates

Stage 0: `condition`

powershell_module or (cmd_execution and get_help)

Stage 1: `powershell_module`

powershell_module:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains|all:
        - 'Pester'
        - 'Get-Help'

Stage 2: `cmd_execution`

cmd_execution:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
        - 'pester'
        - ';'

Stage 3: `get_help`

get_help:
    CommandLine|contains:
        - 'help'
        - '\?'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`;` corpus 2 (sigma 2) `Get-Help` `Pester` `\?` `help` `pester`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 132 (sigma 130, splunk 2) `\powershell.exe` corpus 181 (sigma 180, splunk 1) `\pwsh.exe` corpus 166 (sigma 166)	`field:"Image" kind:ends_with`

Firewall deactivation (deprecated command)

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker disabled the Windows Firewall to evade defense.

Known False Positives

Administrator activity

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1686` Disable or Modify System Firewall

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Firewall deactivation (deprecated command)
description: Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
- https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection_event:
    EventID: 4688
    NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"

  selection_command:
    Commandline|contains|all: # full command 'netsh firewall set opmode disable'
      - firewall
      - set
      - opmode
      - disable

  selection_obfuscated: # full command 'netsh f s o d'
    Commandline|contains|all:
      - netsh
      - ' f*' # firewall
      - ' s*' # set
      - ' o*' # opmode
      - ' d*'  # disable
  condition: selection_event and (selection_command or selection_obfuscated)
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection_event and (selection_command or selection_obfuscated)

Stage 1: `selection_event`

selection_event:
  EventID: 4688
  NewProcessName|endswith: '\netsh.exe'

Stage 2: `selection_command`

selection_command:
  Commandline|contains|all:
    - firewall
    - set
    - opmode
    - disable

Stage 3: `selection_obfuscated`

selection_obfuscated:
  Commandline|contains|all:
    - netsh
    - ' f*'
    - ' s*'
    - ' o*'
    - ' d*'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Commandline`	match	`d` `f` `o` `s` corpus 3 (sigma 3) `disable` corpus 13 (sigma 10, splunk 3) `firewall` corpus 13 (sigma 7, splunk 6) `netsh` corpus 9 (sigma 9) `opmode` corpus 2 (sigma 2) `set` corpus 11 (sigma 10, splunk 1)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\netsh.exe` corpus 28 (sigma 28)	`field:"Image" kind:ends_with value:"\netsh.exe"`

HackTool - SafetyKatz Execution

Status: test
Severity: critical
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: HackTool - SafetyKatz Execution
id: b1876533-4ed5-4a83-90f3-b8645840a413
status: test
description: Detects the execution of the hacktool SafetyKatz via PE information and default Image name
references:
    - https://github.com/GhostPack/SafetyKatz
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-20
modified: 2023-02-04
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\SafetyKatz.exe'
        - OriginalFileName: 'SafetyKatz.exe'
        - Description: 'SafetyKatz'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\SafetyKatz.exe'
    - OriginalFileName: 'SafetyKatz.exe'
    - Description: 'SafetyKatz'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`SafetyKatz`	`field:"Description" kind:eq value:"SafetyKatz"`
`Image`	ends_with	`\SafetyKatz.exe`	`field:"Image" kind:ends_with value:"\SafetyKatz.exe"`
`OriginalFileName`	eq	`SafetyKatz.exe`	`field:"OriginalFileName" kind:eq value:"SafetyKatz.exe"`

HackTool - Wmiexec Default Powershell Command

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	No specific technique
Lateral Movement	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: HackTool - Wmiexec Default Powershell Command
id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0
status: test
description: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script
references:
    - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-08
tags:
    - attack.lateral-movement
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains: '-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc`	`field:"CommandLine" kind:match value:"-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc"`

Invoke-Obfuscation Via Stdin - Security

Status: test
Severity: high
Author: Nikita Nazarov, oscd.community
Source: github.com/SigmaHQ/sigma

Detects Obfuscated Powershell via Stdin in Scripts

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Stealth	`T1027` Obfuscated Files or Information

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4697: A service was installed in the system.

Rule Body

title: Invoke-Obfuscation Via Stdin - Security
id: 80b708f3-d034-40e4-a6c8-d23b7a7db3d1
related:
    - id: 487c7524-f892-4054-b263-8a0ace63fc25
      type: derived
status: test
description: Detects Obfuscated Powershell via Stdin in Scripts
references:
    - https://github.com/SigmaHQ/sigma/issues/1009 # (Task28)
author: Nikita Nazarov, oscd.community
date: 2020-10-12
modified: 2022-11-29
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains|all:
            - 'set'
            - '&&'
        ServiceFileName|contains:
            - 'environment'
            - 'invoke'
            - '${input)'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4697
    ServiceFileName|contains|all:
        - 'set'
        - '&&'
    ServiceFileName|contains:
        - 'environment'
        - 'invoke'
        - '${input)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ServiceFileName`	match	`${input)` `&&` corpus 3 (sigma 3) `environment` `invoke` corpus 2 (sigma 2) `set`	`field:"ServiceFileName" kind:match`

macOS DNS Query Tools for C2

Status: experimental
Severity: medium
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects execution of DNS query tools (dig, nslookup, host, dnscat2) which may indicate DNS tunneling for command and control communication. Adversaries use DNS queries to exfiltrate data or receive commands while evading network controls.

Known False Positives

Network troubleshooting and DNS diagnostics
Automated monitoring scripts checking DNS resolution
System administration tasks

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1071.004` Application Layer Protocol: DNS `T1568` Dynamic Resolution

Rule Body

title: macOS DNS Query Tools for C2
id: 06b33424-75d1-4993-b57f-eca4580b408a
status: experimental
description: 'Detects execution of DNS query tools (dig, nslookup, host, dnscat2)
  which may

  indicate DNS tunneling for command and control communication. Adversaries use

  DNS queries to exfiltrate data or receive commands while evading network controls.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1071/004/
- https://attack.mitre.org/techniques/T1568/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /dig
    - /nslookup
    - /host
    - /dnscat
    - /dnscat2
  condition: selection_event and selection_process
falsepositives:
- Network troubleshooting and DNS diagnostics
- Automated monitoring scripts checking DNS resolution
- System administration tasks
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.command_and_control
- attack.t1071.004
- attack.t1568
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /dig
  - /nslookup
  - /host
  - /dnscat
  - /dnscat2

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/dig` `/dnscat` `/dnscat2` `/host` `/nslookup`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`

macOS ULS Potential TCC Bypass Indicators

Status: experimental
Severity: medium
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detect logs referencing TCC errors or denials that might indicate attempts to bypass privacy controls.

Known False Positives

noisy applications frequently requesting sensitive entitlements

Rule Body

title: macOS ULS Potential TCC Bypass Indicators
id: d5a8a3c7-58a6-4a8a-9e07-4ad7a0e6ec0a
status: experimental
description: Detect logs referencing TCC errors or denials that might indicate attempts
  to bypass privacy controls.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: medium
detection:
  selection:
    message|contains:
    - TCC
    - kTCCService
    - access denied
    - prompting for access
  condition: selection
falsepositives:
- noisy applications frequently requesting sensitive entitlements
modified: 2025/01/15

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  message|contains:
  - TCC
  - kTCCService
  - access denied
  - prompting for access

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`message`	match	`TCC` `access denied` `kTCCService` `prompting for access`	`field:"message" kind:match`

Potential APT FIN7 POWERHOLD Execution

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule Body

title: Potential APT FIN7 POWERHOLD Execution
id: 71c432c4-e4da-4eab-ba49-e60ea9a81bca
status: test
description: Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - attack.t1059.001
    - attack.g0046
    - detection.emerging-threats
logsource:
    product: windows
    category: ps_script
    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
    selection:
        ScriptBlockText|contains|all:
            - '$env:APPDATA'
            - 'function MainPayload'
            - '::WriteAllBytes'
            - 'wscript.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - '$env:APPDATA'
        - 'function MainPayload'
        - '::WriteAllBytes'
        - 'wscript.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`$env:APPDATA` `::WriteAllBytes` `function MainPayload` `wscript.exe`	`field:"ScriptBlockText" kind:match`

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Known False Positives

Web vulnerability scanners

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule Body

title: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
status: test
description: Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877
references:
    - https://seclists.org/fulldisclosure/2023/Jan/1
    - https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-20
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-44877
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/login/index.php'
            - 'login='
        cs-uri-query|contains:
            # TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
            - 'login=$('
            # Common keywords related to python reverse shells
            - 'base64'
            - 'subprocess'
            - 'socket'
            - '${IFS}' # Usage of the input field separator to avoid writing spaces
            # B64 Encoded "python" with different offsets
            - 'cHl0aG9u'
            - 'B5dGhvb'
            - 'weXRob2'
    condition: selection
falsepositives:
    - Web vulnerability scanners
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    cs-method: 'POST'
    cs-uri-query|contains|all:
        - '/login/index.php'
        - 'login='
    cs-uri-query|contains:
        - 'login=$('
        - 'base64'
        - 'subprocess'
        - 'socket'
        - '${IFS}'
        - 'cHl0aG9u'
        - 'B5dGhvb'
        - 'weXRob2'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-method`	eq	`POST`	`field:"cs-method" kind:eq value:"POST"`
`cs-uri-query`	match	`${IFS}` `/login/index.php` `B5dGhvb` `base64` `cHl0aG9u` `login=` `login=$(` `socket` `subprocess` `weXRob2`	`field:"cs-uri-query" kind:match`

Potential File Extension Spoofing Using Right-to-Left Override

Status: test
Severity: high
Author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Known False Positives

Filenames that contains scriptures such as arabic or hebrew might make use of this character

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1036.002` Masquerading: Right-to-Left Override

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: Potential File Extension Spoofing Using Right-to-Left Override
id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4
related:
    - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
      type: derived
status: test
description: |
    Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
references:
    - https://redcanary.com/blog/right-to-left-override/
    - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
    - https://tria.ge/241015-l98snsyeje/behavioral2
    - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2024-11-17
modified: 2026-03-20
tags:
    - attack.execution
    - attack.stealth
    - attack.t1036.002
logsource:
    category: file_event
    product: windows
detection:
    selection_rtlo_unicode:
        TargetFilename|contains:
            - '\u202e'  # Unicode RTLO character
            - '[U+202E]'
            # Real char U+202E copied/pasted below
            - '‮'
    selection_extensions:
        TargetFilename|contains:
            - '3pm.'  # Reversed `.mp3`
            - '4pm.'  # Reversed `.mp4`
            - 'cod.'  # Reversed `.doc`
            - 'fdp.'  # Reversed `.pdf`
            - 'ftr.'  # Reversed `.rtf`
            - 'gepj.'  # Reversed `.jpeg`
            - 'gnp.'  # Reversed `.png`
            - 'gpj.'  # Reversed `.jpg`
            - 'ism.'  # Reversed `.msi`
            - 'lmth.'  # Reversed `.html`
            - 'nls.' # Reversed `.sln`
            - 'piz.'  # Reversed `.zip`
            - 'slx.'  # Reversed `.xls`
            - 'tdo.'  # Reversed `.odt`
            - 'vsc.'  # Reversed `.csv`
            - 'vwm.'  # Reversed `.wmv`
            - 'xcod.'  # Reversed `.docx`
            - 'xslx.'  # Reversed `.xlsx`
            - 'xtpp.'  # Reversed `.pptx`
    condition: all of selection_*
falsepositives:
    - Filenames that contains scriptures such as arabic or hebrew might make use of this character
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_rtlo_unicode`

selection_rtlo_unicode:
    TargetFilename|contains:
        - '\u202e'
        - '[U+202E]'
        - '‮'

Stage 2: `selection_extensions`

selection_extensions:
    TargetFilename|contains:
        - '3pm.'
        - '4pm.'
        - 'cod.'
        - 'fdp.'
        - 'ftr.'
        - 'gepj.'
        - 'gnp.'
        - 'gpj.'
        - 'ism.'
        - 'lmth.'
        - 'nls.'
        - 'piz.'
        - 'slx.'
        - 'tdo.'
        - 'vsc.'
        - 'vwm.'
        - 'xcod.'
        - 'xslx.'
        - 'xtpp.'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	match	`3pm.` `4pm.` `[U+202E]` `\u202e` `cod.` `fdp.` `ftr.` `gepj.` `gnp.` `gpj.` `ism.` `lmth.` `nls.` `piz.` `slx.` `tdo.` `vsc.` `vwm.` `xcod.` `xslx.` `xtpp.` `‮` corpus 2 (sigma 1, elastic 1)	`field:"TargetFilename" kind:match`

Potential PSFactoryBuffer COM Hijacking

Status: test
Severity: high
Author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1546.015` Event Triggered Execution: Component Object Model Hijacking
Privilege Escalation	`T1546.015` Event Triggered Execution: Component Object Model Hijacking

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule Body

title: Potential PSFactoryBuffer COM Hijacking
id: 243380fa-11eb-4141-af92-e14925e77c1b
status: test
description: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
references:
    - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
    - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
    - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
    - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
date: 2023-06-07
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
    filter_main:
        Details:
            - '%windir%\System32\ActXPrxy.dll'
            - 'C:\Windows\System32\ActXPrxy.dll'
    condition: selection and not filter_main
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter_main

Stage 1: `selection`

selection:
    TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'

Stage 2: `not filter_main`

filter_main:
    Details:
        - '%windir%\System32\ActXPrxy.dll'
        - 'C:\Windows\System32\ActXPrxy.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)`	`field:"TargetObject" kind:ends_with value:"\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	eq	`%windir%\System32\ActXPrxy.dll`	`excludes:Details` `field:"Details" value:"%windir%\System32\ActXPrxy.dll"`
`Details`	eq	`C:\Windows\System32\ActXPrxy.dll`	`excludes:Details` `field:"Details" value:"C:\Windows\System32\ActXPrxy.dll"`

PUA - NSudo Execution

Status: test
Severity: high
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
Source: github.com/SigmaHQ/sigma

Detects the use of NSudo tool for command execution

Known False Positives

Legitimate use by administrators

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1569.002` System Services: Service Execution

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: PUA - NSudo Execution
id: 771d1eb5-9587-4568-95fb-9ec44153a012
status: test
description: Detects the use of NSudo tool for command execution
references:
    - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
date: 2022-01-24
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\NSudo.exe'
              - '\NSudoLC.exe'
              - '\NSudoLG.exe'
        - OriginalFileName:
              - 'NSudo.exe'
              - 'NSudoLC.exe'
              - 'NSudoLG.exe'
    selection_cli:
        CommandLine|contains:
            # Covers Single/Double dash "-"/"--" + ":"
            - '-U:S ' # System
            - '-U:T ' # Trusted Installer
            - '-U:E ' # Elevated
            - '-P:E ' # Enable All Privileges
            - '-M:S ' # System Integrity
            - '-M:H ' # High Integrity
            # Covers Single/Double dash "-"/"--" + "="
            - '-U=S '
            - '-U=T '
            - '-U=E '
            - '-P=E '
            - '-M=S '
            - '-M=H '
            - '-ShowWindowMode:Hide'
    condition: all of selection_*
falsepositives:
    - Legitimate use by administrators
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\NSudo.exe'
          - '\NSudoLC.exe'
          - '\NSudoLG.exe'
    - OriginalFileName:
          - 'NSudo.exe'
          - 'NSudoLC.exe'
          - 'NSudoLG.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - '-U:S '
        - '-U:T '
        - '-U:E '
        - '-P:E '
        - '-M:S '
        - '-M:H '
        - '-U=S '
        - '-U=T '
        - '-U=E '
        - '-P=E '
        - '-M=S '
        - '-M=H '
        - '-ShowWindowMode:Hide'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-M:H` `-M:S` `-M=H` `-M=S` `-P:E` `-P=E` `-ShowWindowMode:Hide` `-U:E` `-U:S` `-U:T` `-U=E` `-U=S` `-U=T`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\NSudo.exe` `\NSudoLC.exe` `\NSudoLG.exe`	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`NSudo.exe` `NSudoLC.exe` `NSudoLG.exe`	`field:"OriginalFileName" kind:eq`

Rapid creation of clients with the dynamic client registration endpoint

Status: experimental
Severity: medium
Author: Okta
Source: github.com/auth0/auth0-customer-detections

Detect when a large number of clients are created in a short period of time using dynamic client registration. This can indicate an attempt to create multiple clients for malicious purposes, such as denial of service, resource exhaustion, phishing (consent phishing) by creating look-alike applications, and causing admin fatigue by overwhelming the admin with clients.

Known False Positives

None

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Impact	`T1499` Endpoint Denial of Service

Rule Body

title: Rapid creation of clients with the dynamic client registration endpoint
id: 4bf28f3a-716c-11f0-9932-723487b9527c
status: experimental
description: |
    Detect when a large number of clients are created in a short period of time using dynamic client registration.
    This can indicate an attempt to create multiple clients for malicious purposes, such as denial of service, resource exhaustion,
    phishing (consent phishing) by creating look-alike applications, and causing admin fatigue by overwhelming the admin with clients.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: sapi
        data.description: "Dynamic client registration"
    condition: selection
explanation: >
    The query collects log entries captured when a client is created using dynamic client registration.
    The Splunk detection below observes the number of clients created within a specified time window.
    It alerts if an excessive number of clients, denoted by threshold_for_max_clients_created, have been created within a specified time window.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=sapi data.description="Dynamic client registration"
    | fields data.details.response.body.client_id
    | eval original_time = _time
    ```Adapt the time span to your needs, e.g. 10 min, 1 hour, 1 day, etc.```
    | bin _time span=1h
    | stats count as count_clients, max(original_time) as max_time,
    min(original_time) as min_time, values(data.details.response.body.client_id) as created_clients by _time
    | eval created_within_mininutes = (max_time - min_time)/60
        ```Filter out clients created within a given time period, e.g. 60 minutes```
    | where created_within_mininutes < {threshold_for_observed_time_window_in_minutes}
        ```Count clients created within the time window```
    | where count_clients > {threshold_for_max_clients_created}
    ```Display the information in a table```
    | table created_clients, created_within_mininutes, count_clients
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name, the threshold for the maximum number of clients created within a specified time window,
      i.e. {threshold_for_max_clients_created}, and the time window to observe, i.e. {threshold_for_observed_time_window_in_minutes}.
    - The time window can be adjusted based on the customer's environment and the expected number of clients.
tenant_logs: |
    type:sapi AND description:"Dynamic client registration"
prevention:
    - Harden access to the dynamic client registration (DCR) endpoint with Auth0 Tenant ACL or by placing a specialised WAF in front of your tenant.
    - Disable temporary the DCR end point
    - Consider adopting OAuth Client ID Metadata Document standard (adopted by IETF Oct 2025)
      https://datatracker.ietf.org/doc/draft-parecki-oauth-client-id-metadata-document/
falsepositives:
    - None
level: medium
tags:
    - attack.impact
    - attack.credential-access
    - attack.t1499
    - attack.t1566

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    data.type: sapi
    data.description: "Dynamic client registration"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`data.description`	eq	`Dynamic client registration`	`field:"data.description" kind:eq value:"Dynamic client registration"`
`data.type`	eq	`sapi`	`field:"data.type" kind:eq value:"sapi"`

Rundll32 Registered COM Objects

Status: test
Severity: high
Author: frack113
Source: github.com/SigmaHQ/sigma

load malicious registered COM objects

Known False Positives

Legitimate use

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1546.015` Event Triggered Execution: Component Object Model Hijacking
Privilege Escalation	`T1546.015` Event Triggered Execution: Component Object Model Hijacking

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Rundll32 Registered COM Objects
id: f1edd233-30b5-4823-9e6a-c4171b24d316
status: test
description: load malicious registered COM objects
references:
    - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md
author: frack113
date: 2022-02-13
modified: 2023-02-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_cli:
        CommandLine|contains:
            - '-sta '
            - '-localserver '
        CommandLine|contains|all:
            - '{'
            - '}'
    condition: all of selection_*
falsepositives:
    - Legitimate use
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - '-sta '
        - '-localserver '
    CommandLine|contains|all:
        - '{'
        - '}'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-localserver` `-sta` `{` corpus 2 (sigma 1, splunk 1) `}` corpus 2 (sigma 1, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`OriginalFileName`	eq	`RUNDLL32.EXE` corpus 72 (sigma 35, splunk 21, elastic 16)	`field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"`

Security Service Disabled Via Reg.EXE

Status: test
Severity: high
Author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim
Source: github.com/SigmaHQ/sigma

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Security Service Disabled Via Reg.EXE
id: 5e95028c-5229-4214-afae-d653d573d0ec
status: test
description: Detects execution of "reg.exe" to disable security services such as Windows Defender.
references:
    - https://twitter.com/JohnLaTwC/status/1415295021041979392
    - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1
    - https://vms.drweb.fr/virus/?i=24144899
    - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim
date: 2021-07-14
modified: 2023-06-05
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg_add:
        CommandLine|contains|all:
            - 'reg'
            - 'add'
    selection_cli_reg_start:
        CommandLine|contains|all:
            - 'd 4'
            - 'v Start'
        CommandLine|contains:
            - '\AppIDSvc'
            - '\MsMpSvc'
            - '\NisSrv'
            - '\SecurityHealthService'
            - '\Sense'
            - '\UsoSvc'
            - '\WdBoot'
            - '\WdFilter'
            - '\WdNisDrv'
            - '\WdNisSvc'
            - '\WinDefend'
            - '\wscsvc'
            - '\wuauserv'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_reg_add`

selection_reg_add:
    CommandLine|contains|all:
        - 'reg'
        - 'add'

Stage 2: `selection_cli_reg_start`

selection_cli_reg_start:
    CommandLine|contains|all:
        - 'd 4'
        - 'v Start'
    CommandLine|contains:
        - '\AppIDSvc'
        - '\MsMpSvc'
        - '\NisSrv'
        - '\SecurityHealthService'
        - '\Sense'
        - '\UsoSvc'
        - '\WdBoot'
        - '\WdFilter'
        - '\WdNisDrv'
        - '\WdNisSvc'
        - '\WinDefend'
        - '\wscsvc'
        - '\wuauserv'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\AppIDSvc` `\MsMpSvc` `\NisSrv` `\SecurityHealthService` `\Sense` `\UsoSvc` `\WdBoot` `\WdFilter` `\WdNisDrv` `\WdNisSvc` `\WinDefend` `\wscsvc` `\wuauserv` `add` corpus 30 (sigma 26, splunk 4) `d 4` `reg` corpus 6 (sigma 5, splunk 1) `v Start`	`field:"CommandLine" kind:match`

Shai-Hulud 2.0 Malicious NPM Package Installation

Status: experimental
Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1195.002` Supply Chain Compromise: Compromise Software Supply Chain

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Shai-Hulud 2.0 Malicious NPM Package Installation
id: bae7c70b-8569-44e9-accf-b30073da8a5d
related:
    - id: 514f533b-f56e-421d-80b0-f7706a3e9d23
      type: similar
status: experimental
description: |
    Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
references:
    - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
    - https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-28
tags:
    - attack.initial-access
    - attack.execution
    - attack.t1195.002
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
        CommandLine|contains:
            - 'install'
            - ' i '
  # List of known malicious packages and versions from the Shai-Hulud 2.0 campaign
    selection_packages:
        CommandLine|contains:
            - '02-echo@0.0.7'
            - '@accordproject/concerto-analysis@3.24.1'
            - '@accordproject/concerto-linter@3.24.1'
            - '@accordproject/concerto-linter-default-ruleset@3.24.1'
            - '@accordproject/concerto-metamodel@3.12.5'
            - '@accordproject/concerto-types@3.24.1'
            - '@accordproject/markdown-it-cicero@0.16.26'
            - '@accordproject/template-engine@2.7.2'
            - '@actbase/css-to-react-native-transform@1.0.3'
            - '@actbase/native@0.1.32'
            - '@actbase/node-server@1.1.19'
            - '@actbase/react-absolute@0.8.3'
            - '@actbase/react-daum-postcode@1.0.5'
            - '@actbase/react-kakaosdk@0.9.27'
            - '@actbase/react-native-actionsheet@1.0.3'
            - '@actbase/react-native-devtools@0.1.3'
            - '@actbase/react-native-fast-image@8.5.13'
            - '@actbase/react-native-kakao-channel@1.0.2'
            - '@actbase/react-native-kakao-navi@2.0.4'
            - '@actbase/react-native-less-transformer@1.0.6'
            - '@actbase/react-native-naver-login@1.0.1'
            - '@actbase/react-native-simple-video@1.0.13'
            - '@actbase/react-native-tiktok@1.1.3'
            - '@afetcan/api@0.0.13'
            - '@afetcan/storage@0.0.27'
            - '@alaan/s2s-auth@2.0.3'
            - '@alexadark/amadeus-api@1.0.4'
            - '@alexadark/gatsby-theme-events@1.0.1'
            - '@alexadark/gatsby-theme-wordpress-blog@2.0.1'
            - '@alexadark/reusable-functions@1.5.1'
            - '@alexcolls/nuxt-socket.io@0.0.7'
            - '@alexcolls/nuxt-socket.io@0.0.8'
            - '@alexcolls/nuxt-ux@0.6.1'
            - '@alexcolls/nuxt-ux@0.6.2'
            - '@antstackio/eslint-config-antstack@0.0.3'
            - '@antstackio/express-graphql-proxy@0.2.8'
            - '@antstackio/graphql-body-parser@0.1.1'
            - '@antstackio/json-to-graphql@1.0.3'
            - '@antstackio/shelbysam@1.1.7'
            - '@aryanhussain/my-angular-lib@0.0.23'
            - '@asyncapi/avro-schema-parser@3.0.25'
            - '@asyncapi/avro-schema-parser@3.0.26'
            - '@asyncapi/bundler@0.6.5'
            - '@asyncapi/bundler@0.6.6'
            - '@asyncapi/cli@4.1.2'
            - '@asyncapi/cli@4.1.3'
            - '@asyncapi/converter@1.6.3'
            - '@asyncapi/converter@1.6.4'
            - '@asyncapi/diff@0.5.1'
            - '@asyncapi/diff@0.5.2'
            - '@asyncapi/dotnet-rabbitmq-template@1.0.1'
            - '@asyncapi/dotnet-rabbitmq-template@1.0.2'
            - '@asyncapi/edavisualiser@1.2.1'
            - '@asyncapi/edavisualiser@1.2.2'
            - '@asyncapi/generator-components@0.3.2'
            - '@asyncapi/generator-components@0.3.3'
            - '@asyncapi/generator-react-sdk@1.1.4'
            - '@asyncapi/generator-react-sdk@1.1.5'
            - '@asyncapi/generator@2.8.5'
            - '@asyncapi/generator@2.8.6'
            - '@asyncapi/go-watermill-template@0.2.76'
            - '@asyncapi/go-watermill-template@0.2.77'
            - '@asyncapi/html-template@3.3.2'
            - '@asyncapi/html-template@3.3.3'
            - '@asyncapi/java-spring-cloud-stream-template@0.13.5'
            - '@asyncapi/java-spring-cloud-stream-template@0.13.6'
            - '@asyncapi/java-spring-template@1.6.1'
            - '@asyncapi/java-spring-template@1.6.2'
            - '@asyncapi/java-template@0.3.5'
            - '@asyncapi/java-template@0.3.6'
            - '@asyncapi/keeper@0.0.2'
            - '@asyncapi/keeper@0.0.3'
            - '@asyncapi/markdown-template@1.6.8'
            - '@asyncapi/markdown-template@1.6.9'
            - '@asyncapi/modelina-cli@5.10.2'
            - '@asyncapi/modelina-cli@5.10.3'
            - '@asyncapi/modelina@5.10.2'
            - '@asyncapi/modelina@5.10.3'
            - '@asyncapi/multi-parser@2.2.1'
            - '@asyncapi/multi-parser@2.2.2'
            - '@asyncapi/nodejs-template@3.0.5'
            - '@asyncapi/nodejs-template@3.0.6'
            - '@asyncapi/nodejs-ws-template@0.10.1'
            - '@asyncapi/nodejs-ws-template@0.10.2'
            - '@asyncapi/nunjucks-filters@2.1.1'
            - '@asyncapi/nunjucks-filters@2.1.2'
            - '@asyncapi/openapi-schema-parser@3.0.25'
            - '@asyncapi/openapi-schema-parser@3.0.26'
            - '@asyncapi/optimizer@1.0.5'
            - '@asyncapi/optimizer@1.0.6'
            - '@asyncapi/parser@3.4.1'
            - '@asyncapi/parser@3.4.2'
            - '@asyncapi/php-template@0.1.1'
            - '@asyncapi/php-template@0.1.2'
            - '@asyncapi/problem@1.0.1'
            - '@asyncapi/problem@1.0.2'
            - '@asyncapi/protobuf-schema-parser@3.5.2'
            - '@asyncapi/protobuf-schema-parser@3.5.3'
            - '@asyncapi/protobuf-schema-parser@3.6.1'
            - '@asyncapi/python-paho-template@0.2.14'
            - '@asyncapi/python-paho-template@0.2.15'
            - '@asyncapi/react-component@2.6.6'
            - '@asyncapi/react-component@2.6.7'
            - '@asyncapi/server-api@0.16.24'
            - '@asyncapi/server-api@0.16.25'
            - '@asyncapi/specs@6.10.1'
            - '@asyncapi/specs@6.8.2'
            - '@asyncapi/specs@6.8.3'
            - '@asyncapi/specs@6.9.1'
            - '@asyncapi/studio@1.0.2'
            - '@asyncapi/studio@1.0.3'
            - '@asyncapi/web-component@2.6.6'
            - '@asyncapi/web-component@2.6.7'
            - '@bdkinc/knex-ibmi@0.5.7'
            - '@browserbasehq/bb9@1.2.21'
            - '@browserbasehq/director-ai@1.0.3'
            - '@browserbasehq/mcp-server-browserbase@2.4.2'
            - '@browserbasehq/mcp@2.1.1'
            - '@browserbasehq/sdk-functions@0.0.4'
            - '@browserbasehq/stagehand-docs@1.0.1'
            - '@browserbasehq/stagehand@3.0.4'
            - '@caretive/caret-cli@0.0.2'
            - '@chtijs/eslint-config@1.0.1'
            - '@clausehq/flows-step-httprequest@0.1.14'
            - '@clausehq/flows-step-jsontoxml@0.1.14'
            - '@clausehq/flows-step-mqtt@0.1.14'
            - '@clausehq/flows-step-sendgridemail@0.1.14'
            - '@clausehq/flows-step-taskscreateurl@0.1.14'
            - '@cllbk/ghl@1.3.1'
            - '@commute/bloom@1.0.3'
            - '@commute/market-data-chartjs@2.3.1'
            - '@commute/market-data@1.0.2'
            - '@dev-blinq/ai-qa-logic@1.0.19'
            - '@dev-blinq/blinqioclient@1.0.21'
            - '@dev-blinq/cucumber-js@1.0.131'
            - '@dev-blinq/cucumber_client@1.0.738'
            - '@dev-blinq/ui-systems@1.0.93'
            - '@elsedev/react-csr-sdk@0.2.2'
            - '@ensdomains/address-encoder@1.1.5'
            - '@ensdomains/blacklist@1.0.1'
            - '@ensdomains/buffer@0.1.2'
            - '@ensdomains/ccip-read-cf-worker@0.0.4'
            - '@ensdomains/ccip-read-dns-gateway@0.1.1'
            - '@ensdomains/ccip-read-router@0.0.7'
            - '@ensdomains/ccip-read-worker-viem@0.0.4'
            - '@ensdomains/content-hash@3.0.1'
            - '@ensdomains/curvearithmetics@1.0.1'
            - '@ensdomains/cypress-metamask@1.2.1'
            - '@ensdomains/dnsprovejs@0.5.3'
            - '@ensdomains/dnssec-oracle-anchors@0.0.2'
            - '@ensdomains/dnssecoraclejs@0.2.9'
            - '@ensdomains/durin-middleware@0.0.2'
            - '@ensdomains/durin@0.1.2'
            - '@ensdomains/ens-archived-contracts@0.0.3'
            - '@ensdomains/ens-avatar@1.0.4'
            - '@ensdomains/ens-contracts@1.6.1'
            - '@ensdomains/ens-test-env@1.0.2'
            - '@ensdomains/ens-validation@0.1.1'
            - '@ensdomains/ensjs-react@0.0.5'
            - '@ensdomains/ensjs@4.0.3'
            - '@ensdomains/eth-ens-namehash@2.0.16'
            - '@ensdomains/hackathon-registrar@1.0.5'
            - '@ensdomains/hardhat-chai-matchers-viem@0.1.15'
            - '@ensdomains/hardhat-toolbox-viem-extended@0.0.6'
            - '@ensdomains/mock@2.1.52'
            - '@ensdomains/name-wrapper@1.0.1'
            - '@ensdomains/offchain-resolver-contracts@0.2.2'
            - '@ensdomains/op-resolver-contracts@0.0.2'
            - '@ensdomains/react-ens-address@0.0.32'
            - '@ensdomains/renewal-widget@0.1.10'
            - '@ensdomains/renewal@0.0.13'
            - '@ensdomains/reverse-records@1.0.1'
            - '@ensdomains/server-analytics@0.0.2'
            - '@ensdomains/solsha1@0.0.4'
            - '@ensdomains/subdomain-registrar@0.2.4'
            - '@ensdomains/test-utils@1.3.1'
            - '@ensdomains/thorin@0.6.51'
            - '@ensdomains/ui@3.4.6'
            - '@ensdomains/unicode-confusables@0.1.1'
            - '@ensdomains/unruggable-gateways@0.0.3'
            - '@ensdomains/vite-plugin-i18next-loader@4.0.4'
            - '@ensdomains/web3modal@1.10.2'
            - '@everreal/react-charts@2.0.1'
            - '@everreal/react-charts@2.0.2'
            - '@everreal/validate-esmoduleinterop-imports@1.4.4'
            - '@everreal/validate-esmoduleinterop-imports@1.4.5'
            - '@everreal/web-analytics@0.0.1'
            - '@everreal/web-analytics@0.0.2'
            - '@faq-component/core@0.0.4'
            - '@faq-component/react@1.0.1'
            - '@fishingbooker/browser-sync-plugin@1.0.5'
            - '@fishingbooker/react-loader@1.0.7'
            - '@fishingbooker/react-pagination@2.0.6'
            - '@fishingbooker/react-raty@2.0.1'
            - '@fishingbooker/react-swiper@0.1.5'
            - '@hapheus/n8n-nodes-pgp@1.5.1'
            - '@hover-design/core@0.0.1'
            - '@hover-design/react@0.2.1'
            - '@huntersofbook/auth-vue@0.4.2'
            - '@huntersofbook/core-nuxt@0.4.2'
            - '@huntersofbook/core@0.5.1'
            - '@huntersofbook/form-naiveui@0.5.1'
            - '@huntersofbook/i18n@0.8.2'
            - '@huntersofbook/ui@0.5.1'
            - '@hyperlook/telemetry-sdk@1.0.19'
            - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.2'
            - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.3'
            - '@ifings/design-system@4.9.2'
            - '@ifings/metatron3@0.1.5'
            - '@jayeshsadhwani/telemetry-sdk@1.0.14'
            - '@kvytech/cli@0.0.7'
            - '@kvytech/components@0.0.2'
            - '@kvytech/habbit-e2e-test@0.0.2'
            - '@kvytech/medusa-plugin-announcement@0.0.8'
            - '@kvytech/medusa-plugin-management@0.0.5'
            - '@kvytech/medusa-plugin-newsletter@0.0.5'
            - '@kvytech/medusa-plugin-product-reviews@0.0.9'
            - '@kvytech/medusa-plugin-promotion@0.0.2'
            - '@kvytech/web@0.0.2'
            - '@lessondesk/api-client@9.12.2'
            - '@lessondesk/api-client@9.12.3'
            - '@lessondesk/babel-preset@1.0.1'
            - '@lessondesk/electron-group-api-client@1.0.3'
            - '@lessondesk/eslint-config@1.4.2'
            - '@lessondesk/material-icons@1.0.3'
            - '@lessondesk/react-table-context@2.0.4'
            - '@lessondesk/schoolbus@5.2.2'
            - '@lessondesk/schoolbus@5.2.3'
            - '@livecms/live-edit@0.0.32'
            - '@livecms/nuxt-live-edit@1.9.2'
            - '@lokeswari-satyanarayanan/rn-zustand-expo-template@1.0.9'
            - '@louisle2/core@1.0.1'
            - '@louisle2/cortex-js@0.1.6'
            - '@lpdjs/firestore-repo-service@1.0.1'
            - '@lui-ui/lui-nuxt@0.1.1'
            - '@lui-ui/lui-tailwindcss@0.1.2'
            - '@lui-ui/lui-vue@1.0.13'
            - '@markvivanco/app-version-checker@1.0.1'
            - '@markvivanco/app-version-checker@1.0.2'
            - '@mcp-use/cli@2.2.6'
            - '@mcp-use/cli@2.2.7'
            - '@mcp-use/inspector@0.6.2'
            - '@mcp-use/inspector@0.6.3'
            - '@mcp-use/mcp-use@1.0.1'
            - '@mcp-use/mcp-use@1.0.2'
            - '@micado-digital/stadtmarketing-kufstein-external@1.9.1'
            - '@mizzle-dev/orm@0.0.2'
            - '@mparpaillon/connector-parse@1.0.1'
            - '@mparpaillon/imagesloaded@4.1.2'
            - '@mparpaillon/page@1.0.1'
            - '@ntnx/passport-wso2@0.0.3'
            - '@ntnx/t@0.0.101'
            - '@oku-ui/accordion@0.6.2'
            - '@oku-ui/alert-dialog@0.6.2'
            - '@oku-ui/arrow@0.6.2'
            - '@oku-ui/aspect-ratio@0.6.2'
            - '@oku-ui/avatar@0.6.2'
            - '@oku-ui/checkbox@0.6.3'
            - '@oku-ui/collapsible@0.6.2'
            - '@oku-ui/collection@0.6.2'
            - '@oku-ui/dialog@0.6.2'
            - '@oku-ui/direction@0.6.2'
            - '@oku-ui/dismissable-layer@0.6.2'
            - '@oku-ui/focus-guards@0.6.2'
            - '@oku-ui/focus-scope@0.6.2'
            - '@oku-ui/hover-card@0.6.2'
            - '@oku-ui/label@0.6.2'
            - '@oku-ui/menu@0.6.2'
            - '@oku-ui/motion-nuxt@0.2.2'
            - '@oku-ui/motion@0.4.4'
            - '@oku-ui/popover@0.6.2'
            - '@oku-ui/popper@0.6.2'
            - '@oku-ui/portal@0.6.2'
            - '@oku-ui/presence@0.6.2'
            - '@oku-ui/primitive@0.6.2'
            - '@oku-ui/primitives-nuxt@0.3.1'
            - '@oku-ui/primitives@0.7.9'
            - '@oku-ui/progress@0.6.2'
            - '@oku-ui/provide@0.6.2'
            - '@oku-ui/radio-group@0.6.2'
            - '@oku-ui/roving-focus@0.6.2'
            - '@oku-ui/scroll-area@0.6.2'
            - '@oku-ui/separator@0.6.2'
            - '@oku-ui/slider@0.6.2'
            - '@oku-ui/slot@0.6.2'
            - '@oku-ui/switch@0.6.2'
            - '@oku-ui/tabs@0.6.2'
            - '@oku-ui/toast@0.6.2'
            - '@oku-ui/toggle-group@0.6.2'
            - '@oku-ui/toggle@0.6.2'
            - '@oku-ui/toolbar@0.6.2'
            - '@oku-ui/tooltip@0.6.2'
            - '@oku-ui/use-composable@0.6.2'
            - '@oku-ui/utils@0.6.2'
            - '@oku-ui/visually-hidden@0.6.2'
            - '@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode@2.0.5'
            - '@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode@1.1.1'
            - '@orbitgtbelgium/orbit-components@1.2.9'
            - '@orbitgtbelgium/time-slider@1.0.187'
            - '@osmanekrem/bmad@1.0.6'
            - '@osmanekrem/error-handler@1.2.2'
            - '@pergel/cli@0.11.1'
            - '@pergel/module-box@0.6.1'
            - '@pergel/module-graphql@0.6.1'
            - '@pergel/module-ui@0.0.9'
            - '@pergel/nuxt@0.25.5'
            - '@posthog/agent@1.24.1'
            - '@posthog/ai@7.1.2'
            - '@posthog/automatic-cohorts-plugin@0.0.8'
            - '@posthog/bitbucket-release-tracker@0.0.8'
            - '@posthog/cli@0.5.15'
            - '@posthog/clickhouse@1.7.1'
            - '@posthog/core@1.5.6'
            - '@posthog/currency-normalization-plugin@0.0.8'
            - '@posthog/customerio-plugin@0.0.8'
            - '@posthog/databricks-plugin@0.0.8'
            - '@posthog/drop-events-on-property-plugin@0.0.8'
            - '@posthog/event-sequence-timer-plugin@0.0.8'
            - '@posthog/filter-out-plugin@0.0.8'
            - '@posthog/first-time-event-tracker@0.0.8'
            - '@posthog/geoip-plugin@0.0.8'
            - '@posthog/github-release-tracking-plugin@0.0.8'
            - '@posthog/gitub-star-sync-plugin@0.0.8'
            - '@posthog/heartbeat-plugin@0.0.8'
            - '@posthog/hedgehog-mode@0.0.42'
            - '@posthog/icons@0.36.1'
            - '@posthog/ingestion-alert-plugin@0.0.8'
            - '@posthog/intercom-plugin@0.0.8'
            - '@posthog/kinesis-plugin@0.0.8'
            - '@posthog/laudspeaker-plugin@0.0.8'
            - '@posthog/lemon-ui@0.0.1'
            - '@posthog/maxmind-plugin@0.1.6'
            - '@posthog/migrator3000-plugin@0.0.8'
            - '@posthog/netdata-event-processing@0.0.8'
            - '@posthog/nextjs-config@1.5.1'
            - '@posthog/nextjs@0.0.3'
            - '@posthog/nuxt@1.2.9'
            - '@posthog/pagerduty-plugin@0.0.8'
            - '@posthog/piscina@3.2.1'
            - '@posthog/plugin-contrib@0.0.6'
            - '@posthog/plugin-server@1.10.8'
            - '@posthog/plugin-unduplicates@0.0.8'
            - '@posthog/postgres-plugin@0.0.8'
            - '@posthog/react-rrweb-player@1.1.4'
            - '@posthog/rrdom@0.0.31'
            - '@posthog/rrweb-player@0.0.31'
            - '@posthog/rrweb-record@0.0.31'
            - '@posthog/rrweb-replay@0.0.19'
            - '@posthog/rrweb-snapshot@0.0.31'
            - '@posthog/rrweb-utils@0.0.31'
            - '@posthog/rrweb@0.0.31'
            - '@posthog/sendgrid-plugin@0.0.8'
            - '@posthog/siphash@1.1.2'
            - '@posthog/snowflake-export-plugin@0.0.8'
            - '@posthog/taxonomy-plugin@0.0.8'
            - '@posthog/twilio-plugin@0.0.8'
            - '@posthog/twitter-followers-plugin@0.0.8'
            - '@posthog/url-normalizer-plugin@0.0.8'
            - '@posthog/variance-plugin@0.0.8'
            - '@posthog/web-dev-server@1.0.5'
            - '@posthog/wizard@1.18.1'
            - '@posthog/zendesk-plugin@0.0.8'
            - '@postman/aether-icons@2.23.2'
            - '@postman/aether-icons@2.23.3'
            - '@postman/aether-icons@2.23.4'
            - '@postman/csv-parse@4.0.3'
            - '@postman/csv-parse@4.0.4'
            - '@postman/csv-parse@4.0.5'
            - '@postman/final-node-keytar@7.9.1'
            - '@postman/final-node-keytar@7.9.2'
            - '@postman/final-node-keytar@7.9.3'
            - '@postman/mcp-ui-client@5.5.1'
            - '@postman/mcp-ui-client@5.5.2'
            - '@postman/mcp-ui-client@5.5.3'
            - '@postman/node-keytar@7.9.4'
            - '@postman/node-keytar@7.9.5'
            - '@postman/node-keytar@7.9.6'
            - '@postman/pm-bin-linux-x64@1.24.3'
            - '@postman/pm-bin-linux-x64@1.24.4'
            - '@postman/pm-bin-linux-x64@1.24.5'
            - '@postman/pm-bin-macos-arm64@1.24.3'
            - '@postman/pm-bin-macos-arm64@1.24.4'
            - '@postman/pm-bin-macos-arm64@1.24.5'
            - '@postman/pm-bin-macos-x64@1.24.3'
            - '@postman/pm-bin-macos-x64@1.24.4'
            - '@postman/pm-bin-macos-x64@1.24.5'
            - '@postman/pm-bin-windows-x64@1.24.3'
            - '@postman/pm-bin-windows-x64@1.24.4'
            - '@postman/pm-bin-windows-x64@1.24.5'
            - '@postman/postman-collection-fork@4.3.3'
            - '@postman/postman-collection-fork@4.3.4'
            - '@postman/postman-collection-fork@4.3.5'
            - '@postman/postman-mcp-cli@1.0.3'
            - '@postman/postman-mcp-cli@1.0.4'
            - '@postman/postman-mcp-cli@1.0.5'
            - '@postman/postman-mcp-server@2.4.10'
            - '@postman/postman-mcp-server@2.4.11'
            - '@postman/postman-mcp-server@2.4.12'
            - '@postman/pretty-ms@6.1.1'
            - '@postman/pretty-ms@6.1.2'
            - '@postman/pretty-ms@6.1.3'
            - '@postman/secret-scanner-wasm@2.1.2'
            - '@postman/secret-scanner-wasm@2.1.3'
            - '@postman/secret-scanner-wasm@2.1.4'
            - '@postman/tunnel-agent@0.6.5'
            - '@postman/tunnel-agent@0.6.6'
            - '@postman/tunnel-agent@0.6.7'
            - '@postman/wdio-allure-reporter@0.0.7'
            - '@postman/wdio-allure-reporter@0.0.8'
            - '@postman/wdio-allure-reporter@0.0.9'
            - '@postman/wdio-junit-reporter@0.0.4'
            - '@postman/wdio-junit-reporter@0.0.5'
            - '@postman/wdio-junit-reporter@0.0.6'
            - '@pradhumngautam/common-app@1.0.2'
            - '@productdevbook/animejs-vue@0.2.1'
            - '@productdevbook/auth@0.2.2'
            - '@productdevbook/chatwoot@2.0.1'
            - '@productdevbook/motion@1.0.4'
            - '@productdevbook/ts-i18n@1.4.2'
            - '@pruthvi21/use-debounce@1.0.3'
            - '@quick-start-soft/quick-document-translator@1.4.2511142126'
            - '@quick-start-soft/quick-git-clean-markdown@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-compose@1.4.2506300029'
            - '@quick-start-soft/quick-markdown-image@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-print@1.4.2511142126'
            - '@quick-start-soft/quick-markdown-translator@1.4.2509202331'
            - '@quick-start-soft/quick-markdown@1.4.2511142126'
            - '@quick-start-soft/quick-remove-image-background@1.4.2511142126'
            - '@quick-start-soft/quick-task-refine@1.4.2511142126'
            - '@relyt/claude-context-core@0.1.1'
            - '@relyt/claude-context-mcp@0.1.1'
            - '@relyt/mcp-server-relytone@0.0.3'
            - '@sameepsi/sor2@2.0.2'
            - '@sameepsi/sor@1.0.3'
            - '@seezo/sdr-mcp-server@0.0.5'
            - '@seung-ju/next@0.0.2'
            - '@seung-ju/openapi-generator@0.0.4'
            - '@seung-ju/react-hooks@0.0.2'
            - '@seung-ju/react-native-action-sheet@0.2.1'
            - '@silgi/better-auth@0.8.1'
            - '@silgi/drizzle@0.8.4'
            - '@silgi/ecosystem@0.7.6'
            - '@silgi/graphql@0.7.15'
            - '@silgi/module-builder@0.8.8'
            - '@silgi/openapi@0.7.4'
            - '@silgi/permission@0.6.8'
            - '@silgi/ratelimit@0.2.1'
            - '@silgi/scalar@0.6.2'
            - '@silgi/yoga@0.7.1'
            - '@sme-ui/aoma-vevasound-metadata-lib@0.1.3'
            - '@strapbuild/react-native-date-time-picker@2.0.4'
            - '@strapbuild/react-native-perspective-image-cropper-2@0.4.7'
            - '@strapbuild/react-native-perspective-image-cropper-poojan31@0.4.6'
            - '@strapbuild/react-native-perspective-image-cropper@0.4.15'
            - '@suraj_h/medium-common@1.0.5'
            - '@thedelta/eslint-config@1.0.2'
            - '@tiaanduplessis/json@2.0.2'
            - '@tiaanduplessis/json@2.0.3'
            - '@tiaanduplessis/react-progressbar@1.0.1'
            - '@tiaanduplessis/react-progressbar@1.0.2'
            - '@trackstar/angular-trackstar-link@1.0.2'
            - '@trackstar/react-trackstar-link-upgrade@1.1.10'
            - '@trackstar/react-trackstar-link@2.0.21'
            - '@trackstar/test-angular-package@0.0.9'
            - '@trackstar/test-package@1.1.5'
            - '@trefox/sleekshop-js@0.1.6'
            - '@trigo/atrix-acl@4.0.2'
            - '@trigo/atrix-elasticsearch@2.0.1'
            - '@trigo/atrix-mongoose@1.0.2'
            - '@trigo/atrix-orientdb@1.0.2'
            - '@trigo/atrix-postgres@1.0.3'
            - '@trigo/atrix-pubsub@4.0.3'
            - '@trigo/atrix-redis@1.0.2'
            - '@trigo/atrix-soap@1.0.2'
            - '@trigo/atrix-swagger@3.0.1'
            - '@trigo/atrix@7.0.1'
            - '@trigo/bool-expressions@4.1.3'
            - '@trigo/eslint-config-trigo@3.3.1'
            - '@trigo/fsm@3.4.2'
            - '@trigo/hapi-auth-signedlink@1.3.1'
            - '@trigo/jsdt@0.2.1'
            - '@trigo/keycloak-api@1.3.1'
            - '@trigo/node-soap@0.5.4'
            - '@trigo/pathfinder-ui-css@0.1.1'
            - '@trigo/trigo-hapijs@5.0.1'
            - '@trpc-rate-limiter/cloudflare@0.1.4'
            - '@trpc-rate-limiter/hono@0.1.4'
            - '@varsityvibe/api-client@1.3.36'
            - '@varsityvibe/api-client@1.3.37'
            - '@varsityvibe/utils@5.0.6'
            - '@varsityvibe/validation-schemas@0.6.7'
            - '@varsityvibe/validation-schemas@0.6.8'
            - '@viapip/eslint-config@0.2.4'
            - '@vishadtyagi/full-year-calendar@0.1.11'
            - '@voiceflow/alexa-types@2.15.60'
            - '@voiceflow/alexa-types@2.15.61'
            - '@voiceflow/anthropic@0.4.4'
            - '@voiceflow/anthropic@0.4.5'
            - '@voiceflow/api-sdk@3.28.58'
            - '@voiceflow/api-sdk@3.28.59'
            - '@voiceflow/backend-utils@5.0.1'
            - '@voiceflow/backend-utils@5.0.2'
            - '@voiceflow/base-types@2.136.2'
            - '@voiceflow/base-types@2.136.3'
            - '@voiceflow/body-parser@1.21.2'
            - '@voiceflow/body-parser@1.21.3'
            - '@voiceflow/chat-types@2.14.58'
            - '@voiceflow/chat-types@2.14.59'
            - '@voiceflow/circleci-config-sdk-orb-import@0.2.1'
            - '@voiceflow/circleci-config-sdk-orb-import@0.2.2'
            - '@voiceflow/commitlint-config@2.6.1'
            - '@voiceflow/commitlint-config@2.6.2'
            - '@voiceflow/common@8.9.1'
            - '@voiceflow/common@8.9.2'
            - '@voiceflow/default-prompt-wrappers@1.7.3'
            - '@voiceflow/default-prompt-wrappers@1.7.4'
            - '@voiceflow/dependency-cruiser-config@1.8.11'
            - '@voiceflow/dependency-cruiser-config@1.8.12'
            - '@voiceflow/dtos-interact@1.40.1'
            - '@voiceflow/dtos-interact@1.40.2'
            - '@voiceflow/encryption@0.3.2'
            - '@voiceflow/encryption@0.3.3'
            - '@voiceflow/eslint-config@7.16.4'
            - '@voiceflow/eslint-config@7.16.5'
            - '@voiceflow/eslint-plugin@1.6.1'
            - '@voiceflow/eslint-plugin@1.6.2'
            - '@voiceflow/exception@1.10.1'
            - '@voiceflow/exception@1.10.2'
            - '@voiceflow/fetch@1.11.1'
            - '@voiceflow/fetch@1.11.2'
            - '@voiceflow/general-types@3.2.22'
            - '@voiceflow/general-types@3.2.23'
            - '@voiceflow/git-branch-check@1.4.3'
            - '@voiceflow/git-branch-check@1.4.4'
            - '@voiceflow/google-dfes-types@2.17.12'
            - '@voiceflow/google-dfes-types@2.17.13'
            - '@voiceflow/google-types@2.21.12'
            - '@voiceflow/google-types@2.21.13'
            - '@voiceflow/husky-config@1.3.1'
            - '@voiceflow/husky-config@1.3.2'
            - '@voiceflow/logger@2.4.2'
            - '@voiceflow/logger@2.4.3'
            - '@voiceflow/metrics@1.5.1'
            - '@voiceflow/metrics@1.5.2'
            - '@voiceflow/natural-language-commander@0.5.2'
            - '@voiceflow/natural-language-commander@0.5.3'
            - '@voiceflow/nestjs-common@2.75.2'
            - '@voiceflow/nestjs-common@2.75.3'
            - '@voiceflow/nestjs-mongodb@1.3.1'
            - '@voiceflow/nestjs-mongodb@1.3.2'
            - '@voiceflow/nestjs-rate-limit@1.3.2'
            - '@voiceflow/nestjs-rate-limit@1.3.3'
            - '@voiceflow/nestjs-redis@1.3.1'
            - '@voiceflow/nestjs-redis@1.3.2'
            - '@voiceflow/nestjs-timeout@1.3.1'
            - '@voiceflow/nestjs-timeout@1.3.2'
            - '@voiceflow/npm-package-json-lint-config@1.1.1'
            - '@voiceflow/npm-package-json-lint-config@1.1.2'
            - '@voiceflow/openai@3.2.2'
            - '@voiceflow/openai@3.2.3'
            - '@voiceflow/pino-pretty@4.4.1'
            - '@voiceflow/pino-pretty@4.4.2'
            - '@voiceflow/pino@6.11.3'
            - '@voiceflow/pino@6.11.4'
            - '@voiceflow/prettier-config@1.10.1'
            - '@voiceflow/prettier-config@1.10.2'
            - '@voiceflow/react-chat@1.65.3'
            - '@voiceflow/react-chat@1.65.4'
            - '@voiceflow/runtime-client-js@1.17.2'
            - '@voiceflow/runtime-client-js@1.17.3'
            - '@voiceflow/runtime@1.29.1'
            - '@voiceflow/runtime@1.29.2'
            - '@voiceflow/sdk-runtime@1.43.1'
            - '@voiceflow/sdk-runtime@1.43.2'
            - '@voiceflow/secrets-provider@1.9.2'
            - '@voiceflow/secrets-provider@1.9.3'
            - '@voiceflow/semantic-release-config@1.4.1'
            - '@voiceflow/semantic-release-config@1.4.2'
            - '@voiceflow/serverless-plugin-typescript@2.1.7'
            - '@voiceflow/serverless-plugin-typescript@2.1.8'
            - '@voiceflow/slate-serializer@1.7.3'
            - '@voiceflow/slate-serializer@1.7.4'
            - '@voiceflow/stitches-react@2.3.2'
            - '@voiceflow/stitches-react@2.3.3'
            - '@voiceflow/storybook-config@1.2.2'
            - '@voiceflow/storybook-config@1.2.3'
            - '@voiceflow/stylelint-config@1.1.1'
            - '@voiceflow/stylelint-config@1.1.2'
            - '@voiceflow/test-common@2.1.1'
            - '@voiceflow/test-common@2.1.2'
            - '@voiceflow/tsconfig-paths@1.1.4'
            - '@voiceflow/tsconfig-paths@1.1.5'
            - '@voiceflow/tsconfig@1.12.1'
            - '@voiceflow/tsconfig@1.12.2'
            - '@voiceflow/utils-designer@1.74.19'
            - '@voiceflow/utils-designer@1.74.20'
            - '@voiceflow/verror@1.1.4'
            - '@voiceflow/verror@1.1.5'
            - '@voiceflow/vite-config@2.6.2'
            - '@voiceflow/vite-config@2.6.3'
            - '@voiceflow/vitest-config@1.10.2'
            - '@voiceflow/vitest-config@1.10.3'
            - '@voiceflow/voice-types@2.10.58'
            - '@voiceflow/voice-types@2.10.59'
            - '@voiceflow/voiceflow-types@3.32.45'
            - '@voiceflow/voiceflow-types@3.32.46'
            - '@voiceflow/widget@1.7.18'
            - '@voiceflow/widget@1.7.19'
            - '@vucod/email@0.0.3'
            - '@zapier/ai-actions-react@0.1.12'
            - '@zapier/ai-actions-react@0.1.13'
            - '@zapier/ai-actions-react@0.1.14'
            - '@zapier/ai-actions@0.1.18'
            - '@zapier/ai-actions@0.1.19'
            - '@zapier/ai-actions@0.1.20'
            - '@zapier/babel-preset-zapier@6.4.1'
            - '@zapier/babel-preset-zapier@6.4.2'
            - '@zapier/babel-preset-zapier@6.4.3'
            - '@zapier/browserslist-config-zapier@1.0.3'
            - '@zapier/browserslist-config-zapier@1.0.4'
            - '@zapier/browserslist-config-zapier@1.0.5'
            - '@zapier/eslint-plugin-zapier@11.0.3'
            - '@zapier/eslint-plugin-zapier@11.0.4'
            - '@zapier/eslint-plugin-zapier@11.0.5'
            - '@zapier/mcp-integration@3.0.1'
            - '@zapier/mcp-integration@3.0.2'
            - '@zapier/mcp-integration@3.0.3'
            - '@zapier/secret-scrubber@1.1.3'
            - '@zapier/secret-scrubber@1.1.4'
            - '@zapier/secret-scrubber@1.1.5'
            - '@zapier/spectral-api-ruleset@1.9.1'
            - '@zapier/spectral-api-ruleset@1.9.2'
            - '@zapier/spectral-api-ruleset@1.9.3'
            - '@zapier/stubtree@0.1.2'
            - '@zapier/stubtree@0.1.3'
            - '@zapier/stubtree@0.1.4'
            - '@zapier/zapier-sdk@0.15.5'
            - '@zapier/zapier-sdk@0.15.6'
            - '@zapier/zapier-sdk@0.15.7'
            - 'ai-crowl-shield@1.0.7'
            - 'arc-cli-fc@1.0.1'
            - 'asciitranslator@1.0.3'
            - 'asyncapi-preview@1.0.1'
            - 'asyncapi-preview@1.0.2'
            - 'atrix-mongoose@1.0.1'
            - 'atrix@1.0.1'
            - 'automation_model@1.0.491'
            - 'avvvatars-vue@1.1.2'
            - 'axios-builder@1.2.1'
            - 'axios-cancelable@1.0.1'
            - 'axios-cancelable@1.0.2'
            - 'axios-timed@1.0.1'
            - 'axios-timed@1.0.2'
            - 'babel-preset-kinvey-flex-service@0.1.1'
            - 'barebones-css@1.1.3'
            - 'barebones-css@1.1.4'
            - 'benmostyn-frame-print@1.0.1'
            - 'bestgpiocontroller@1.0.10'
            - 'better-auth-nuxt@0.0.10'
            - 'better-queue-nedb@0.1.5'
            - 'bidirectional-adapter@1.2.2'
            - 'bidirectional-adapter@1.2.3'
            - 'bidirectional-adapter@1.2.4'
            - 'bidirectional-adapter@1.2.5'
            - 'blinqio-executions-cli@1.0.41'
            - 'blob-to-base64@1.0.3'
            - 'bool-expressions@0.1.2'
            - 'buffered-interpolation-babylon6@0.2.8'
            - 'bun-plugin-httpfile@0.1.1'
            - 'bytecode-checker-cli@1.0.10'
            - 'bytecode-checker-cli@1.0.11'
            - 'bytecode-checker-cli@1.0.8'
            - 'bytecode-checker-cli@1.0.9'
            - 'bytes-to-x@1.0.1'
            - 'calc-loan-interest@1.0.4'
            - 'capacitor-plugin-apptrackingios@0.0.21'
            - 'capacitor-plugin-purchase@0.1.1'
            - 'capacitor-plugin-scgssigninwithgoogle@0.0.5'
            - 'capacitor-purchase-history@0.0.10'
            - 'capacitor-voice-recorder-wav@6.0.3'
            - 'cbre-flow-common@1.3.1'
            - 'cbre-flow-common@1.3.2'
            - 'ceviz@0.0.5'
            - 'chrome-extension-downloads@0.0.3'
            - 'chrome-extension-downloads@0.0.4'
            - 'claude-token-updater@1.0.3'
            - 'coinmarketcap-api@3.1.2'
            - 'coinmarketcap-api@3.1.3'
            - 'colors-regex@2.0.1'
            - 'command-irail@0.5.4'
            - 'compare-obj@1.1.1'
            - 'compare-obj@1.1.2'
            - 'composite-reducer@1.0.2'
            - 'composite-reducer@1.0.3'
            - 'composite-reducer@1.0.4'
            - 'composite-reducer@1.0.5'
            - 'count-it-down@1.0.1'
            - 'count-it-down@1.0.2'
            - 'cpu-instructions@0.0.14'
            - 'create-director-app@0.1.1'
            - 'create-glee-app@0.2.2'
            - 'create-glee-app@0.2.3'
            - 'create-hardhat3-app@1.1.1'
            - 'create-hardhat3-app@1.1.2'
            - 'create-hardhat3-app@1.1.3'
            - 'create-hardhat3-app@1.1.4'
            - 'create-kinvey-flex-service@0.2.1'
            - 'create-mcp-use-app@0.5.3'
            - 'create-mcp-use-app@0.5.4'
            - 'create-silgi@0.3.1'
            - 'crypto-addr-codec@0.1.9'
            - 'css-dedoupe@0.1.2'
            - 'csv-tool-cli@1.2.1'
            - 'dashboard-empty-state@1.0.3'
            - 'designstudiouiux@1.0.1'
            - 'devstart-cli@1.0.6'
            - 'dialogflow-es@1.1.1'
            - 'dialogflow-es@1.1.2'
            - 'dialogflow-es@1.1.3'
            - 'dialogflow-es@1.1.4'
            - 'discord-bot-server@0.1.2'
            - 'docusaurus-plugin-vanilla-extract@1.0.3'
            - 'dont-go@1.1.2'
            - 'dotnet-template@0.0.3'
            - 'dotnet-template@0.0.4'
            - 'drop-events-on-property-plugin@0.0.2'
            - 'easypanel-sdk@0.3.2'
            - 'electron-volt@0.0.2'
            - 'email-deliverability-tester@1.1.1'
            - 'enforce-branch-name@1.1.3'
            - 'esbuild-plugin-brotli@0.2.1'
            - 'esbuild-plugin-eta@0.1.1'
            - 'esbuild-plugin-httpfile@0.4.1'
            - 'eslint-config-kinvey-flex-service@0.1.1'
            - 'eslint-config-nitpicky@4.0.1'
            - 'eslint-config-trigo@22.0.2'
            - 'eslint-config-zeallat-base@1.0.4'
            - 'ethereum-ens@0.8.1'
            - 'evm-checkcode-cli@1.0.12'
            - 'evm-checkcode-cli@1.0.13'
            - 'evm-checkcode-cli@1.0.14'
            - 'evm-checkcode-cli@1.0.15'
            - 'exact-ticker@0.3.5'
            - 'expo-audio-session@0.2.1'
            - 'expo-router-on-rails@0.0.4'
            - 'express-starter-template@1.0.10'
            - 'expressos@1.1.3'
            - 'fat-fingered@1.0.1'
            - 'fat-fingered@1.0.2'
            - 'feature-flip@1.0.1'
            - 'feature-flip@1.0.2'
            - 'firestore-search-engine@1.2.3'
            - 'fittxt@1.0.2'
            - 'fittxt@1.0.3'
            - 'flapstacks@1.0.1'
            - 'flapstacks@1.0.2'
            - 'flatten-unflatten@1.0.1'
            - 'flatten-unflatten@1.0.2'
            - 'formik-error-focus@2.0.1'
            - 'formik-store@1.0.1'
            - 'frontity-starter-theme@1.0.1'
            - 'fuzzy-finder@1.0.5'
            - 'fuzzy-finder@1.0.6'
            - 'gate-evm-check-code2@2.0.3'
            - 'gate-evm-check-code2@2.0.4'
            - 'gate-evm-check-code2@2.0.5'
            - 'gate-evm-check-code2@2.0.6'
            - 'gate-evm-tools-test@1.0.5'
            - 'gate-evm-tools-test@1.0.6'
            - 'gate-evm-tools-test@1.0.7'
            - 'gate-evm-tools-test@1.0.8'
            - 'gatsby-plugin-antd@2.2.1'
            - 'gatsby-plugin-cname@1.0.1'
            - 'gatsby-plugin-cname@1.0.2'
            - 'generator-meteor-stock@0.1.6'
            - 'generator-ng-itobuz@0.0.15'
            - 'get-them-args@1.3.3'
            - 'github-action-for-generator@2.1.27'
            - 'github-action-for-generator@2.1.28'
            - 'gitsafe@1.0.5'
            - 'go-template@0.1.8'
            - 'go-template@0.1.9'
            - 'gulp-inject-envs@1.2.1'
            - 'gulp-inject-envs@1.2.2'
            - 'haufe-axera-api-client@0.0.1'
            - 'haufe-axera-api-client@0.0.2'
            - 'hope-mapboxdraw@0.1.1'
            - 'hopedraw@1.0.3'
            - 'hover-design-prototype@0.0.5'
            - 'httpness@1.0.2'
            - 'httpness@1.0.3'
            - 'hyper-fullfacing@1.0.3'
            - 'hyperterm-hipster@1.0.7'
            - 'ids-css@1.5.1'
            - 'ids-enterprise-mcp-server@0.0.2'
            - 'ids-enterprise-ng@20.1.6'
            - 'ids-enterprise-typings@20.1.6'
            - 'image-to-uri@1.0.1'
            - 'image-to-uri@1.0.2'
            - 'insomnia-plugin-random-pick@1.0.4'
            - 'invo@0.2.2'
            - 'iron-shield-miniapp@0.0.2'
            - 'ito-button@8.0.3'
            - 'itobuz-angular-auth@8.0.11'
            - 'itobuz-angular-button@8.0.11'
            - 'itobuz-angular@0.0.1'
            - 'jacob-zuma@1.0.1'
            - 'jacob-zuma@1.0.2'
            - 'jaetut-varit-test@1.0.2'
            - 'jan-browser@0.13.1'
            - 'jquery-bindings@1.1.2'
            - 'jquery-bindings@1.1.3'
            - 'jsonsurge@1.0.7'
            - 'just-toasty@1.7.1'
            - 'kill-port@2.0.2'
            - 'kill-port@2.0.3'
            - 'kinetix-default-token-list@1.0.5'
            - 'kinvey-cli-wrapper@0.3.1'
            - 'kinvey-flex-scripts@0.5.1'
            - 'kns-error-code@1.0.8'
            - 'korea-administrative-area-geo-json-util@1.0.7'
            - 'kwami@1.5.10'
            - 'kwami@1.5.9'
            - 'lang-codes@1.0.1'
            - 'lang-codes@1.0.2'
            - 'license-o-matic@1.2.1'
            - 'license-o-matic@1.2.2'
            - 'lint-staged-imagemin@1.3.1'
            - 'lint-staged-imagemin@1.3.2'
            - 'lite-serper-mcp-server@0.2.2'
            - 'lui-vue-test@0.70.9'
            - 'luno-api@1.2.3'
            - 'm25-transaction-utils@1.1.16'
            - 'manual-billing-system-miniapp-api@1.3.1'
            - 'mcp-use@1.4.2'
            - 'mcp-use@1.4.3'
            - 'medusa-plugin-announcement@0.0.3'
            - 'medusa-plugin-logs@0.0.17'
            - 'medusa-plugin-momo@0.0.68'
            - 'medusa-plugin-product-reviews-kvy@0.0.4'
            - 'medusa-plugin-zalopay@0.0.40'
            - 'mod10-check-digit@1.0.1'
            - 'mon-package-react-typescript@1.0.1'
            - 'my-saeed-lib@0.1.1'
            - 'n8n-nodes-tmdb@0.5.1'
            - 'n8n-nodes-vercel-ai-sdk@0.1.7'
            - 'n8n-nodes-viral-app@0.2.5'
            - 'nanoreset@7.0.1'
            - 'nanoreset@7.0.2'
            - 'next-circular-dependency@1.0.2'
            - 'next-circular-dependency@1.0.3'
            - 'next-simple-google-analytics@1.1.1'
            - 'next-simple-google-analytics@1.1.2'
            - 'next-styled-nprogress@1.0.4'
            - 'next-styled-nprogress@1.0.5'
            - 'ngx-useful-swiper-prosenjit@9.0.2'
            - 'ngx-wooapi@12.0.1'
            - 'nitro-graphql@1.5.12'
            - 'nitro-kutu@0.1.1'
            - 'nitrodeploy@1.0.8'
            - 'nitroping@0.1.1'
            - 'normal-store@1.3.1'
            - 'normal-store@1.3.2'
            - 'normal-store@1.3.3'
            - 'normal-store@1.3.4'
            - 'nuxt-keycloak@0.2.2'
            - 'obj-to-css@1.0.2'
            - 'obj-to-css@1.0.3'
            - 'okta-react-router-6@5.0.1'
            - 'open2internet@0.1.1'
            - 'orbit-boxicons@2.1.3'
            - 'orbit-nebula-draw-tools@1.0.10'
            - 'orbit-nebula-editor@1.0.2'
            - 'orbit-soap@0.43.13'
            - 'orchestrix@12.1.2'
            - 'package-tester@1.0.1'
            - 'parcel-plugin-asset-copier@1.1.2'
            - 'parcel-plugin-asset-copier@1.1.3'
            - 'pdf-annotation@0.0.2'
            - 'pergel@0.13.2'
            - 'pergeltest@0.0.25'
            - 'piclite@1.0.1'
            - 'pico-uid@1.0.3'
            - 'pico-uid@1.0.4'
            - 'pkg-readme@1.1.1'
            - 'poper-react-sdk@0.1.2'
            - 'posthog-docusaurus@2.0.6'
            - 'posthog-js@1.297.3'
            - 'posthog-node@4.18.1'
            - 'posthog-node@5.11.3'
            - 'posthog-node@5.13.3'
            - 'posthog-plugin-hello-world@1.0.1'
            - 'posthog-react-native-session-replay@1.2.2'
            - 'posthog-react-native@4.11.1'
            - 'posthog-react-native@4.12.5'
            - 'prime-one-table@0.0.19'
            - 'prompt-eng-server@1.0.18'
            - 'prompt-eng@1.0.50'
            - 'puny-req@1.0.3'
            - 'quickswap-ads-list@1.0.33'
            - 'quickswap-default-staking-list-address@1.0.55'
            - 'quickswap-default-staking-list@1.0.11'
            - 'quickswap-default-token-list@1.5.16'
            - 'quickswap-router-sdk@1.0.1'
            - 'quickswap-sdk@3.0.44'
            - 'quickswap-smart-order-router@1.0.1'
            - 'quickswap-token-lists@1.0.3'
            - 'quickswap-v2-sdk@2.0.1'
            - 'ra-auth-firebase@1.0.3'
            - 'ra-data-firebase@1.0.7'
            - 'ra-data-firebase@1.0.8'
            - 'react-component-taggers@0.1.9'
            - 'react-data-to-export@1.0.1'
            - 'react-element-prompt-inspector@0.1.18'
            - 'react-favic@1.0.2'
            - 'react-hook-form-persist@3.0.1'
            - 'react-hook-form-persist@3.0.2'
            - 'react-jam-icons@1.0.1'
            - 'react-jam-icons@1.0.2'
            - 'react-keycloak-context@1.0.8'
            - 'react-keycloak-context@1.0.9'
            - 'react-library-setup@0.0.6'
            - 'react-linear-loader@1.0.2'
            - 'react-micromodal.js@1.0.1'
            - 'react-micromodal.js@1.0.2'
            - 'react-native-datepicker-modal@1.3.1'
            - 'react-native-datepicker-modal@1.3.2'
            - 'react-native-email@2.1.1'
            - 'react-native-email@2.1.2'
            - 'react-native-fetch@2.0.1'
            - 'react-native-fetch@2.0.2'
            - 'react-native-get-pixel-dimensions@1.0.1'
            - 'react-native-get-pixel-dimensions@1.0.2'
            - 'react-native-google-maps-directions@2.1.2'
            - 'react-native-jam-icons@1.0.1'
            - 'react-native-jam-icons@1.0.2'
            - 'react-native-log-level@1.2.1'
            - 'react-native-log-level@1.2.2'
            - 'react-native-modest-checkbox@3.3.1'
            - 'react-native-modest-storage@2.1.1'
            - 'react-native-phone-call@1.2.1'
            - 'react-native-phone-call@1.2.2'
            - 'react-native-retriable-fetch@2.0.1'
            - 'react-native-retriable-fetch@2.0.2'
            - 'react-native-use-modal@1.0.3'
            - 'react-native-view-finder@1.2.1'
            - 'react-native-view-finder@1.2.2'
            - 'react-native-websocket@1.0.3'
            - 'react-native-websocket@1.0.4'
            - 'react-native-worklet-functions@3.3.3'
            - 'react-packery-component@1.0.3'
            - 'react-qr-image@1.1.1'
            - 'react-scrambled-text@1.0.4'
            - 'rediff-viewer@0.0.7'
            - 'rediff@1.0.5'
            - 'redux-forge@2.5.3'
            - 'redux-router-kit@1.2.2'
            - 'redux-router-kit@1.2.3'
            - 'redux-router-kit@1.2.4'
            - 'revenuecat@1.0.1'
            - 'rollup-plugin-httpfile@0.2.1'
            - 'sa-company-registration-number-regex@1.0.1'
            - 'sa-company-registration-number-regex@1.0.2'
            - 'sa-id-gen@1.0.4'
            - 'sa-id-gen@1.0.5'
            - 'samesame@1.0.3'
            - 'scgs-capacitor-subscribe@1.0.11'
            - 'scgsffcreator@1.0.5'
            - 'schob@1.0.3'
            - 'selenium-session-client@1.0.4'
            - 'selenium-session@1.0.5'
            - 'set-nested-prop@2.0.1'
            - 'set-nested-prop@2.0.2'
            - 'shelf-jwt-sessions@0.1.2'
            - 'shell-exec@1.1.3'
            - 'shell-exec@1.1.4'
            - 'shinhan-limit-scrap@1.0.3'
            - 'silgi@0.43.30'
            - 'simplejsonform@1.0.1'
            - 'skills-use@0.1.1'
            - 'skills-use@0.1.2'
            - 'solomon-api-stories@1.0.2'
            - 'solomon-v3-stories@1.15.6'
            - 'solomon-v3-ui-wrapper@1.6.1'
            - 'soneium-acs@1.0.1'
            - 'sort-by-distance@2.0.1'
            - 'south-african-id-info@1.0.2'
            - 'stat-fns@1.0.1'
            - 'stoor@2.3.2'
            - 'sufetch@0.4.1'
            - 'super-commit@1.0.1'
            - 'svelte-autocomplete-select@1.1.1'
            - 'svelte-toasty@1.1.2'
            - 'svelte-toasty@1.1.3'
            - 'tanstack-shadcn-table@1.1.5'
            - 'tavily-module@1.0.1'
            - 'tcsp-draw-test@1.0.5'
            - 'tcsp-test-vd@2.4.4'
            - 'tcsp@2.0.2'
            - 'template-lib@1.1.3'
            - 'template-lib@1.1.4'
            - 'template-micro-service@1.0.2'
            - 'template-micro-service@1.0.3'
            - 'tenacious-fetch@2.3.2'
            - 'tenacious-fetch@2.3.3'
            - 'test-foundry-app@1.0.1'
            - 'test-foundry-app@1.0.2'
            - 'test-foundry-app@1.0.3'
            - 'test-foundry-app@1.0.4'
            - 'test-hardhat-app@1.0.1'
            - 'test-hardhat-app@1.0.2'
            - 'test-hardhat-app@1.0.3'
            - 'test-hardhat-app@1.0.4'
            - 'test23112222-api@1.0.1'
            - 'tiaan@1.0.2'
            - 'tiptap-shadcn-vue@0.2.1'
            - 'token.js-fork@0.7.32'
            - 'toonfetch@0.3.2'
            - 'trigo-react-app@4.1.2'
            - 'ts-relay-cursor-paging@2.1.1'
            - 'typeface-antonio-complete@1.0.5'
            - 'typefence@1.2.2'
            - 'typefence@1.2.3'
            - 'typeorm-orbit@0.2.27'
            - 'unadapter@0.1.3'
            - 'undefsafe-typed@1.0.3'
            - 'undefsafe-typed@1.0.4'
            - 'unemail@0.3.1'
            - 'uniswap-router-sdk@1.6.2'
            - 'uniswap-smart-order-router@3.16.26'
            - 'uniswap-test-sdk-core@4.0.8'
            - 'unsearch@0.0.3'
            - 'uplandui@0.5.4'
            - 'upload-to-play-store@1.0.1'
            - 'upload-to-play-store@1.0.2'
            - 'url-encode-decode@1.0.1'
            - 'url-encode-decode@1.0.2'
            - 'use-unsaved-changes@1.0.9'
            - 'v-plausible@1.2.1'
            - 'valid-south-african-id@1.0.3'
            - 'valuedex-sdk@3.0.5'
            - 'vf-oss-template@1.0.1'
            - 'vf-oss-template@1.0.2'
            - 'vf-oss-template@1.0.3'
            - 'vf-oss-template@1.0.4'
            - 'victoria-wallet-constants@0.1.1'
            - 'victoria-wallet-constants@0.1.2'
            - 'victoria-wallet-core@0.1.1'
            - 'victoria-wallet-core@0.1.2'
            - 'victoria-wallet-type@0.1.1'
            - 'victoria-wallet-type@0.1.2'
            - 'victoria-wallet-utils@0.1.1'
            - 'victoria-wallet-utils@0.1.2'
            - 'victoria-wallet-validator@0.1.1'
            - 'victoria-wallet-validator@0.1.2'
            - 'victoriaxoaquyet-wallet-core@0.2.1'
            - 'victoriaxoaquyet-wallet-core@0.2.2'
            - 'vite-plugin-httpfile@0.2.1'
            - 'vue-browserupdate-nuxt@1.0.5'
            - 'wallet-evm@0.3.1'
            - 'wallet-evm@0.3.2'
            - 'wallet-type@0.1.1'
            - 'wallet-type@0.1.2'
            - 'web-scraper-mcp@1.1.4'
            - 'web-types-htmx@0.1.1'
            - 'web-types-lit@0.1.1'
            - 'webpack-loader-httpfile@0.2.1'
            - 'wellness-expert-ng-gallery@5.1.1'
            - 'wenk@1.0.10'
            - 'wenk@1.0.9'
            - 'zapier-async-storage@1.0.1'
            - 'zapier-async-storage@1.0.2'
            - 'zapier-async-storage@1.0.3'
            - 'zapier-platform-cli@18.0.2'
            - 'zapier-platform-cli@18.0.3'
            - 'zapier-platform-cli@18.0.4'
            - 'zapier-platform-core@18.0.2'
            - 'zapier-platform-core@18.0.3'
            - 'zapier-platform-core@18.0.4'
            - 'zapier-platform-legacy-scripting-runner@4.0.2'
            - 'zapier-platform-legacy-scripting-runner@4.0.3'
            - 'zapier-platform-legacy-scripting-runner@4.0.4'
            - 'zapier-platform-schema@18.0.2'
            - 'zapier-platform-schema@18.0.3'
            - 'zapier-platform-schema@18.0.4'
            - 'zapier-scripts@7.8.3'
            - 'zapier-scripts@7.8.4'
            - 'zuper-cli@1.0.1'
            - 'zuper-sdk@1.0.57'
            - 'zuper-stream@2.0.9'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_npm_package_installation/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    Image|endswith: '\node.exe'
    CommandLine|contains:
        - 'install'
        - ' i '

Stage 2: `selection_packages`

selection_packages:
    CommandLine|contains:
        - '02-echo@0.0.7'
        - '@accordproject/concerto-analysis@3.24.1'
        - '@accordproject/concerto-linter@3.24.1'
        - '@accordproject/concerto-linter-default-ruleset@3.24.1'
        - '@accordproject/concerto-metamodel@3.12.5'
        - '@accordproject/concerto-types@3.24.1'
        - '@accordproject/markdown-it-cicero@0.16.26'
        - '@accordproject/template-engine@2.7.2'
        - '@actbase/css-to-react-native-transform@1.0.3'
        - '@actbase/native@0.1.32'
        - '@actbase/node-server@1.1.19'
        - '@actbase/react-absolute@0.8.3'
        - '@actbase/react-daum-postcode@1.0.5'
        - '@actbase/react-kakaosdk@0.9.27'
        - '@actbase/react-native-actionsheet@1.0.3'
        - '@actbase/react-native-devtools@0.1.3'
        - '@actbase/react-native-fast-image@8.5.13'
        - '@actbase/react-native-kakao-channel@1.0.2'
        - '@actbase/react-native-kakao-navi@2.0.4'
        - '@actbase/react-native-less-transformer@1.0.6'
        - '@actbase/react-native-naver-login@1.0.1'
        - '@actbase/react-native-simple-video@1.0.13'
        - '@actbase/react-native-tiktok@1.1.3'
        - '@afetcan/api@0.0.13'
        - '@afetcan/storage@0.0.27'
        - '@alaan/s2s-auth@2.0.3'
        - '@alexadark/amadeus-api@1.0.4'
        - '@alexadark/gatsby-theme-events@1.0.1'
        - '@alexadark/gatsby-theme-wordpress-blog@2.0.1'
        - '@alexadark/reusable-functions@1.5.1'
        - '@alexcolls/nuxt-socket.io@0.0.7'
        - '@alexcolls/nuxt-socket.io@0.0.8'
        - '@alexcolls/nuxt-ux@0.6.1'
        - '@alexcolls/nuxt-ux@0.6.2'
        - '@antstackio/eslint-config-antstack@0.0.3'
        - '@antstackio/express-graphql-proxy@0.2.8'
        - '@antstackio/graphql-body-parser@0.1.1'
        - '@antstackio/json-to-graphql@1.0.3'
        - '@antstackio/shelbysam@1.1.7'
        - '@aryanhussain/my-angular-lib@0.0.23'
        - '@asyncapi/avro-schema-parser@3.0.25'
        - '@asyncapi/avro-schema-parser@3.0.26'
        - '@asyncapi/bundler@0.6.5'
        - '@asyncapi/bundler@0.6.6'
        - '@asyncapi/cli@4.1.2'
        - '@asyncapi/cli@4.1.3'
        - '@asyncapi/converter@1.6.3'
        - '@asyncapi/converter@1.6.4'
        - '@asyncapi/diff@0.5.1'
        - '@asyncapi/diff@0.5.2'
        - '@asyncapi/dotnet-rabbitmq-template@1.0.1'
        - '@asyncapi/dotnet-rabbitmq-template@1.0.2'
        - '@asyncapi/edavisualiser@1.2.1'
        - '@asyncapi/edavisualiser@1.2.2'
        - '@asyncapi/generator-components@0.3.2'
        - '@asyncapi/generator-components@0.3.3'
        - '@asyncapi/generator-react-sdk@1.1.4'
        - '@asyncapi/generator-react-sdk@1.1.5'
        - '@asyncapi/generator@2.8.5'
        - '@asyncapi/generator@2.8.6'
        - '@asyncapi/go-watermill-template@0.2.76'
        - '@asyncapi/go-watermill-template@0.2.77'
        - '@asyncapi/html-template@3.3.2'
        - '@asyncapi/html-template@3.3.3'
        - '@asyncapi/java-spring-cloud-stream-template@0.13.5'
        - '@asyncapi/java-spring-cloud-stream-template@0.13.6'
        - '@asyncapi/java-spring-template@1.6.1'
        - '@asyncapi/java-spring-template@1.6.2'
        - '@asyncapi/java-template@0.3.5'
        - '@asyncapi/java-template@0.3.6'
        - '@asyncapi/keeper@0.0.2'
        - '@asyncapi/keeper@0.0.3'
        - '@asyncapi/markdown-template@1.6.8'
        - '@asyncapi/markdown-template@1.6.9'
        - '@asyncapi/modelina-cli@5.10.2'
        - '@asyncapi/modelina-cli@5.10.3'
        - '@asyncapi/modelina@5.10.2'
        - '@asyncapi/modelina@5.10.3'
        - '@asyncapi/multi-parser@2.2.1'
        - '@asyncapi/multi-parser@2.2.2'
        - '@asyncapi/nodejs-template@3.0.5'
        - '@asyncapi/nodejs-template@3.0.6'
        - '@asyncapi/nodejs-ws-template@0.10.1'
        - '@asyncapi/nodejs-ws-template@0.10.2'
        - '@asyncapi/nunjucks-filters@2.1.1'
        - '@asyncapi/nunjucks-filters@2.1.2'
        - '@asyncapi/openapi-schema-parser@3.0.25'
        - '@asyncapi/openapi-schema-parser@3.0.26'
        - '@asyncapi/optimizer@1.0.5'
        - '@asyncapi/optimizer@1.0.6'
        - '@asyncapi/parser@3.4.1'
        - '@asyncapi/parser@3.4.2'
        - '@asyncapi/php-template@0.1.1'
        - '@asyncapi/php-template@0.1.2'
        - '@asyncapi/problem@1.0.1'
        - '@asyncapi/problem@1.0.2'
        - '@asyncapi/protobuf-schema-parser@3.5.2'
        - '@asyncapi/protobuf-schema-parser@3.5.3'
        - '@asyncapi/protobuf-schema-parser@3.6.1'
        - '@asyncapi/python-paho-template@0.2.14'
        - '@asyncapi/python-paho-template@0.2.15'
        - '@asyncapi/react-component@2.6.6'
        - '@asyncapi/react-component@2.6.7'
        - '@asyncapi/server-api@0.16.24'
        - '@asyncapi/server-api@0.16.25'
        - '@asyncapi/specs@6.10.1'
        - '@asyncapi/specs@6.8.2'
        - '@asyncapi/specs@6.8.3'
        - '@asyncapi/specs@6.9.1'
        - '@asyncapi/studio@1.0.2'
        - '@asyncapi/studio@1.0.3'
        - '@asyncapi/web-component@2.6.6'
        - '@asyncapi/web-component@2.6.7'
        - '@bdkinc/knex-ibmi@0.5.7'
        - '@browserbasehq/bb9@1.2.21'
        - '@browserbasehq/director-ai@1.0.3'
        - '@browserbasehq/mcp-server-browserbase@2.4.2'
        - '@browserbasehq/mcp@2.1.1'
        - '@browserbasehq/sdk-functions@0.0.4'
        - '@browserbasehq/stagehand-docs@1.0.1'
        - '@browserbasehq/stagehand@3.0.4'
        - '@caretive/caret-cli@0.0.2'
        - '@chtijs/eslint-config@1.0.1'
        - '@clausehq/flows-step-httprequest@0.1.14'
        - '@clausehq/flows-step-jsontoxml@0.1.14'
        - '@clausehq/flows-step-mqtt@0.1.14'
        - '@clausehq/flows-step-sendgridemail@0.1.14'
        - '@clausehq/flows-step-taskscreateurl@0.1.14'
        - '@cllbk/ghl@1.3.1'
        - '@commute/bloom@1.0.3'
        - '@commute/market-data-chartjs@2.3.1'
        - '@commute/market-data@1.0.2'
        - '@dev-blinq/ai-qa-logic@1.0.19'
        - '@dev-blinq/blinqioclient@1.0.21'
        - '@dev-blinq/cucumber-js@1.0.131'
        - '@dev-blinq/cucumber_client@1.0.738'
        - '@dev-blinq/ui-systems@1.0.93'
        - '@elsedev/react-csr-sdk@0.2.2'
        - '@ensdomains/address-encoder@1.1.5'
        - '@ensdomains/blacklist@1.0.1'
        - '@ensdomains/buffer@0.1.2'
        - '@ensdomains/ccip-read-cf-worker@0.0.4'
        - '@ensdomains/ccip-read-dns-gateway@0.1.1'
        - '@ensdomains/ccip-read-router@0.0.7'
        - '@ensdomains/ccip-read-worker-viem@0.0.4'
        - '@ensdomains/content-hash@3.0.1'
        - '@ensdomains/curvearithmetics@1.0.1'
        - '@ensdomains/cypress-metamask@1.2.1'
        - '@ensdomains/dnsprovejs@0.5.3'
        - '@ensdomains/dnssec-oracle-anchors@0.0.2'
        - '@ensdomains/dnssecoraclejs@0.2.9'
        - '@ensdomains/durin-middleware@0.0.2'
        - '@ensdomains/durin@0.1.2'
        - '@ensdomains/ens-archived-contracts@0.0.3'
        - '@ensdomains/ens-avatar@1.0.4'
        - '@ensdomains/ens-contracts@1.6.1'
        - '@ensdomains/ens-test-env@1.0.2'
        - '@ensdomains/ens-validation@0.1.1'
        - '@ensdomains/ensjs-react@0.0.5'
        - '@ensdomains/ensjs@4.0.3'
        - '@ensdomains/eth-ens-namehash@2.0.16'
        - '@ensdomains/hackathon-registrar@1.0.5'
        - '@ensdomains/hardhat-chai-matchers-viem@0.1.15'
        - '@ensdomains/hardhat-toolbox-viem-extended@0.0.6'
        - '@ensdomains/mock@2.1.52'
        - '@ensdomains/name-wrapper@1.0.1'
        - '@ensdomains/offchain-resolver-contracts@0.2.2'
        - '@ensdomains/op-resolver-contracts@0.0.2'
        - '@ensdomains/react-ens-address@0.0.32'
        - '@ensdomains/renewal-widget@0.1.10'
        - '@ensdomains/renewal@0.0.13'
        - '@ensdomains/reverse-records@1.0.1'
        - '@ensdomains/server-analytics@0.0.2'
        - '@ensdomains/solsha1@0.0.4'
        - '@ensdomains/subdomain-registrar@0.2.4'
        - '@ensdomains/test-utils@1.3.1'
        - '@ensdomains/thorin@0.6.51'
        - '@ensdomains/ui@3.4.6'
        - '@ensdomains/unicode-confusables@0.1.1'
        - '@ensdomains/unruggable-gateways@0.0.3'
        - '@ensdomains/vite-plugin-i18next-loader@4.0.4'
        - '@ensdomains/web3modal@1.10.2'
        - '@everreal/react-charts@2.0.1'
        - '@everreal/react-charts@2.0.2'
        - '@everreal/validate-esmoduleinterop-imports@1.4.4'
        - '@everreal/validate-esmoduleinterop-imports@1.4.5'
        - '@everreal/web-analytics@0.0.1'
        - '@everreal/web-analytics@0.0.2'
        - '@faq-component/core@0.0.4'
        - '@faq-component/react@1.0.1'
        - '@fishingbooker/browser-sync-plugin@1.0.5'
        - '@fishingbooker/react-loader@1.0.7'
        - '@fishingbooker/react-pagination@2.0.6'
        - '@fishingbooker/react-raty@2.0.1'
        - '@fishingbooker/react-swiper@0.1.5'
        - '@hapheus/n8n-nodes-pgp@1.5.1'
        - '@hover-design/core@0.0.1'
        - '@hover-design/react@0.2.1'
        - '@huntersofbook/auth-vue@0.4.2'
        - '@huntersofbook/core-nuxt@0.4.2'
        - '@huntersofbook/core@0.5.1'
        - '@huntersofbook/form-naiveui@0.5.1'
        - '@huntersofbook/i18n@0.8.2'
        - '@huntersofbook/ui@0.5.1'
        - '@hyperlook/telemetry-sdk@1.0.19'
        - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.2'
        - '@ifelsedeveloper/protocol-contracts-svm-idl@0.1.3'
        - '@ifings/design-system@4.9.2'
        - '@ifings/metatron3@0.1.5'
        - '@jayeshsadhwani/telemetry-sdk@1.0.14'
        - '@kvytech/cli@0.0.7'
        - '@kvytech/components@0.0.2'
        - '@kvytech/habbit-e2e-test@0.0.2'
        - '@kvytech/medusa-plugin-announcement@0.0.8'
        - '@kvytech/medusa-plugin-management@0.0.5'
        - '@kvytech/medusa-plugin-newsletter@0.0.5'
        - '@kvytech/medusa-plugin-product-reviews@0.0.9'
        - '@kvytech/medusa-plugin-promotion@0.0.2'
        - '@kvytech/web@0.0.2'
        - '@lessondesk/api-client@9.12.2'
        - '@lessondesk/api-client@9.12.3'
        - '@lessondesk/babel-preset@1.0.1'
        - '@lessondesk/electron-group-api-client@1.0.3'
        - '@lessondesk/eslint-config@1.4.2'
        - '@lessondesk/material-icons@1.0.3'
        - '@lessondesk/react-table-context@2.0.4'
        - '@lessondesk/schoolbus@5.2.2'
        - '@lessondesk/schoolbus@5.2.3'
        - '@livecms/live-edit@0.0.32'
        - '@livecms/nuxt-live-edit@1.9.2'
        - '@lokeswari-satyanarayanan/rn-zustand-expo-template@1.0.9'
        - '@louisle2/core@1.0.1'
        - '@louisle2/cortex-js@0.1.6'
        - '@lpdjs/firestore-repo-service@1.0.1'
        - '@lui-ui/lui-nuxt@0.1.1'
        - '@lui-ui/lui-tailwindcss@0.1.2'
        - '@lui-ui/lui-vue@1.0.13'
        - '@markvivanco/app-version-checker@1.0.1'
        - '@markvivanco/app-version-checker@1.0.2'
        - '@mcp-use/cli@2.2.6'
        - '@mcp-use/cli@2.2.7'
        - '@mcp-use/inspector@0.6.2'
        - '@mcp-use/inspector@0.6.3'
        - '@mcp-use/mcp-use@1.0.1'
        - '@mcp-use/mcp-use@1.0.2'
        - '@micado-digital/stadtmarketing-kufstein-external@1.9.1'
        - '@mizzle-dev/orm@0.0.2'
        - '@mparpaillon/connector-parse@1.0.1'
        - '@mparpaillon/imagesloaded@4.1.2'
        - '@mparpaillon/page@1.0.1'
        - '@ntnx/passport-wso2@0.0.3'
        - '@ntnx/t@0.0.101'
        - '@oku-ui/accordion@0.6.2'
        - '@oku-ui/alert-dialog@0.6.2'
        - '@oku-ui/arrow@0.6.2'
        - '@oku-ui/aspect-ratio@0.6.2'
        - '@oku-ui/avatar@0.6.2'
        - '@oku-ui/checkbox@0.6.3'
        - '@oku-ui/collapsible@0.6.2'
        - '@oku-ui/collection@0.6.2'
        - '@oku-ui/dialog@0.6.2'
        - '@oku-ui/direction@0.6.2'
        - '@oku-ui/dismissable-layer@0.6.2'
        - '@oku-ui/focus-guards@0.6.2'
        - '@oku-ui/focus-scope@0.6.2'
        - '@oku-ui/hover-card@0.6.2'
        - '@oku-ui/label@0.6.2'
        - '@oku-ui/menu@0.6.2'
        - '@oku-ui/motion-nuxt@0.2.2'
        - '@oku-ui/motion@0.4.4'
        - '@oku-ui/popover@0.6.2'
        - '@oku-ui/popper@0.6.2'
        - '@oku-ui/portal@0.6.2'
        - '@oku-ui/presence@0.6.2'
        - '@oku-ui/primitive@0.6.2'
        - '@oku-ui/primitives-nuxt@0.3.1'
        - '@oku-ui/primitives@0.7.9'
        - '@oku-ui/progress@0.6.2'
        - '@oku-ui/provide@0.6.2'
        - '@oku-ui/radio-group@0.6.2'
        - '@oku-ui/roving-focus@0.6.2'
        - '@oku-ui/scroll-area@0.6.2'
        - '@oku-ui/separator@0.6.2'
        - '@oku-ui/slider@0.6.2'
        - '@oku-ui/slot@0.6.2'
        - '@oku-ui/switch@0.6.2'
        - '@oku-ui/tabs@0.6.2'
        - '@oku-ui/toast@0.6.2'
        - '@oku-ui/toggle-group@0.6.2'
        - '@oku-ui/toggle@0.6.2'
        - '@oku-ui/toolbar@0.6.2'
        - '@oku-ui/tooltip@0.6.2'
        - '@oku-ui/use-composable@0.6.2'
        - '@oku-ui/utils@0.6.2'
        - '@oku-ui/visually-hidden@0.6.2'
        - '@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode@2.0.5'
        - '@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode@1.1.1'
        - '@orbitgtbelgium/orbit-components@1.2.9'
        - '@orbitgtbelgium/time-slider@1.0.187'
        - '@osmanekrem/bmad@1.0.6'
        - '@osmanekrem/error-handler@1.2.2'
        - '@pergel/cli@0.11.1'
        - '@pergel/module-box@0.6.1'
        - '@pergel/module-graphql@0.6.1'
        - '@pergel/module-ui@0.0.9'
        - '@pergel/nuxt@0.25.5'
        - '@posthog/agent@1.24.1'
        - '@posthog/ai@7.1.2'
        - '@posthog/automatic-cohorts-plugin@0.0.8'
        - '@posthog/bitbucket-release-tracker@0.0.8'
        - '@posthog/cli@0.5.15'
        - '@posthog/clickhouse@1.7.1'
        - '@posthog/core@1.5.6'
        - '@posthog/currency-normalization-plugin@0.0.8'
        - '@posthog/customerio-plugin@0.0.8'
        - '@posthog/databricks-plugin@0.0.8'
        - '@posthog/drop-events-on-property-plugin@0.0.8'
        - '@posthog/event-sequence-timer-plugin@0.0.8'
        - '@posthog/filter-out-plugin@0.0.8'
        - '@posthog/first-time-event-tracker@0.0.8'
        - '@posthog/geoip-plugin@0.0.8'
        - '@posthog/github-release-tracking-plugin@0.0.8'
        - '@posthog/gitub-star-sync-plugin@0.0.8'
        - '@posthog/heartbeat-plugin@0.0.8'
        - '@posthog/hedgehog-mode@0.0.42'
        - '@posthog/icons@0.36.1'
        - '@posthog/ingestion-alert-plugin@0.0.8'
        - '@posthog/intercom-plugin@0.0.8'
        - '@posthog/kinesis-plugin@0.0.8'
        - '@posthog/laudspeaker-plugin@0.0.8'
        - '@posthog/lemon-ui@0.0.1'
        - '@posthog/maxmind-plugin@0.1.6'
        - '@posthog/migrator3000-plugin@0.0.8'
        - '@posthog/netdata-event-processing@0.0.8'
        - '@posthog/nextjs-config@1.5.1'
        - '@posthog/nextjs@0.0.3'
        - '@posthog/nuxt@1.2.9'
        - '@posthog/pagerduty-plugin@0.0.8'
        - '@posthog/piscina@3.2.1'
        - '@posthog/plugin-contrib@0.0.6'
        - '@posthog/plugin-server@1.10.8'
        - '@posthog/plugin-unduplicates@0.0.8'
        - '@posthog/postgres-plugin@0.0.8'
        - '@posthog/react-rrweb-player@1.1.4'
        - '@posthog/rrdom@0.0.31'
        - '@posthog/rrweb-player@0.0.31'
        - '@posthog/rrweb-record@0.0.31'
        - '@posthog/rrweb-replay@0.0.19'
        - '@posthog/rrweb-snapshot@0.0.31'
        - '@posthog/rrweb-utils@0.0.31'
        - '@posthog/rrweb@0.0.31'
        - '@posthog/sendgrid-plugin@0.0.8'
        - '@posthog/siphash@1.1.2'
        - '@posthog/snowflake-export-plugin@0.0.8'
        - '@posthog/taxonomy-plugin@0.0.8'
        - '@posthog/twilio-plugin@0.0.8'
        - '@posthog/twitter-followers-plugin@0.0.8'
        - '@posthog/url-normalizer-plugin@0.0.8'
        - '@posthog/variance-plugin@0.0.8'
        - '@posthog/web-dev-server@1.0.5'
        - '@posthog/wizard@1.18.1'
        - '@posthog/zendesk-plugin@0.0.8'
        - '@postman/aether-icons@2.23.2'
        - '@postman/aether-icons@2.23.3'
        - '@postman/aether-icons@2.23.4'
        - '@postman/csv-parse@4.0.3'
        - '@postman/csv-parse@4.0.4'
        - '@postman/csv-parse@4.0.5'
        - '@postman/final-node-keytar@7.9.1'
        - '@postman/final-node-keytar@7.9.2'
        - '@postman/final-node-keytar@7.9.3'
        - '@postman/mcp-ui-client@5.5.1'
        - '@postman/mcp-ui-client@5.5.2'
        - '@postman/mcp-ui-client@5.5.3'
        - '@postman/node-keytar@7.9.4'
        - '@postman/node-keytar@7.9.5'
        - '@postman/node-keytar@7.9.6'
        - '@postman/pm-bin-linux-x64@1.24.3'
        - '@postman/pm-bin-linux-x64@1.24.4'
        - '@postman/pm-bin-linux-x64@1.24.5'
        - '@postman/pm-bin-macos-arm64@1.24.3'
        - '@postman/pm-bin-macos-arm64@1.24.4'
        - '@postman/pm-bin-macos-arm64@1.24.5'
        - '@postman/pm-bin-macos-x64@1.24.3'
        - '@postman/pm-bin-macos-x64@1.24.4'
        - '@postman/pm-bin-macos-x64@1.24.5'
        - '@postman/pm-bin-windows-x64@1.24.3'
        - '@postman/pm-bin-windows-x64@1.24.4'
        - '@postman/pm-bin-windows-x64@1.24.5'
        - '@postman/postman-collection-fork@4.3.3'
        - '@postman/postman-collection-fork@4.3.4'
        - '@postman/postman-collection-fork@4.3.5'
        - '@postman/postman-mcp-cli@1.0.3'
        - '@postman/postman-mcp-cli@1.0.4'
        - '@postman/postman-mcp-cli@1.0.5'
        - '@postman/postman-mcp-server@2.4.10'
        - '@postman/postman-mcp-server@2.4.11'
        - '@postman/postman-mcp-server@2.4.12'
        - '@postman/pretty-ms@6.1.1'
        - '@postman/pretty-ms@6.1.2'
        - '@postman/pretty-ms@6.1.3'
        - '@postman/secret-scanner-wasm@2.1.2'
        - '@postman/secret-scanner-wasm@2.1.3'
        - '@postman/secret-scanner-wasm@2.1.4'
        - '@postman/tunnel-agent@0.6.5'
        - '@postman/tunnel-agent@0.6.6'
        - '@postman/tunnel-agent@0.6.7'
        - '@postman/wdio-allure-reporter@0.0.7'
        - '@postman/wdio-allure-reporter@0.0.8'
        - '@postman/wdio-allure-reporter@0.0.9'
        - '@postman/wdio-junit-reporter@0.0.4'
        - '@postman/wdio-junit-reporter@0.0.5'
        - '@postman/wdio-junit-reporter@0.0.6'
        - '@pradhumngautam/common-app@1.0.2'
        - '@productdevbook/animejs-vue@0.2.1'
        - '@productdevbook/auth@0.2.2'
        - '@productdevbook/chatwoot@2.0.1'
        - '@productdevbook/motion@1.0.4'
        - '@productdevbook/ts-i18n@1.4.2'
        - '@pruthvi21/use-debounce@1.0.3'
        - '@quick-start-soft/quick-document-translator@1.4.2511142126'
        - '@quick-start-soft/quick-git-clean-markdown@1.4.2511142126'
        - '@quick-start-soft/quick-markdown-compose@1.4.2506300029'
        - '@quick-start-soft/quick-markdown-image@1.4.2511142126'
        - '@quick-start-soft/quick-markdown-print@1.4.2511142126'
        - '@quick-start-soft/quick-markdown-translator@1.4.2509202331'
        - '@quick-start-soft/quick-markdown@1.4.2511142126'
        - '@quick-start-soft/quick-remove-image-background@1.4.2511142126'
        - '@quick-start-soft/quick-task-refine@1.4.2511142126'
        - '@relyt/claude-context-core@0.1.1'
        - '@relyt/claude-context-mcp@0.1.1'
        - '@relyt/mcp-server-relytone@0.0.3'
        - '@sameepsi/sor2@2.0.2'
        - '@sameepsi/sor@1.0.3'
        - '@seezo/sdr-mcp-server@0.0.5'
        - '@seung-ju/next@0.0.2'
        - '@seung-ju/openapi-generator@0.0.4'
        - '@seung-ju/react-hooks@0.0.2'
        - '@seung-ju/react-native-action-sheet@0.2.1'
        - '@silgi/better-auth@0.8.1'
        - '@silgi/drizzle@0.8.4'
        - '@silgi/ecosystem@0.7.6'
        - '@silgi/graphql@0.7.15'
        - '@silgi/module-builder@0.8.8'
        - '@silgi/openapi@0.7.4'
        - '@silgi/permission@0.6.8'
        - '@silgi/ratelimit@0.2.1'
        - '@silgi/scalar@0.6.2'
        - '@silgi/yoga@0.7.1'
        - '@sme-ui/aoma-vevasound-metadata-lib@0.1.3'
        - '@strapbuild/react-native-date-time-picker@2.0.4'
        - '@strapbuild/react-native-perspective-image-cropper-2@0.4.7'
        - '@strapbuild/react-native-perspective-image-cropper-poojan31@0.4.6'
        - '@strapbuild/react-native-perspective-image-cropper@0.4.15'
        - '@suraj_h/medium-common@1.0.5'
        - '@thedelta/eslint-config@1.0.2'
        - '@tiaanduplessis/json@2.0.2'
        - '@tiaanduplessis/json@2.0.3'
        - '@tiaanduplessis/react-progressbar@1.0.1'
        - '@tiaanduplessis/react-progressbar@1.0.2'
        - '@trackstar/angular-trackstar-link@1.0.2'
        - '@trackstar/react-trackstar-link-upgrade@1.1.10'
        - '@trackstar/react-trackstar-link@2.0.21'
        - '@trackstar/test-angular-package@0.0.9'
        - '@trackstar/test-package@1.1.5'
        - '@trefox/sleekshop-js@0.1.6'
        - '@trigo/atrix-acl@4.0.2'
        - '@trigo/atrix-elasticsearch@2.0.1'
        - '@trigo/atrix-mongoose@1.0.2'
        - '@trigo/atrix-orientdb@1.0.2'
        - '@trigo/atrix-postgres@1.0.3'
        - '@trigo/atrix-pubsub@4.0.3'
        - '@trigo/atrix-redis@1.0.2'
        - '@trigo/atrix-soap@1.0.2'
        - '@trigo/atrix-swagger@3.0.1'
        - '@trigo/atrix@7.0.1'
        - '@trigo/bool-expressions@4.1.3'
        - '@trigo/eslint-config-trigo@3.3.1'
        - '@trigo/fsm@3.4.2'
        - '@trigo/hapi-auth-signedlink@1.3.1'
        - '@trigo/jsdt@0.2.1'
        - '@trigo/keycloak-api@1.3.1'
        - '@trigo/node-soap@0.5.4'
        - '@trigo/pathfinder-ui-css@0.1.1'
        - '@trigo/trigo-hapijs@5.0.1'
        - '@trpc-rate-limiter/cloudflare@0.1.4'
        - '@trpc-rate-limiter/hono@0.1.4'
        - '@varsityvibe/api-client@1.3.36'
        - '@varsityvibe/api-client@1.3.37'
        - '@varsityvibe/utils@5.0.6'
        - '@varsityvibe/validation-schemas@0.6.7'
        - '@varsityvibe/validation-schemas@0.6.8'
        - '@viapip/eslint-config@0.2.4'
        - '@vishadtyagi/full-year-calendar@0.1.11'
        - '@voiceflow/alexa-types@2.15.60'
        - '@voiceflow/alexa-types@2.15.61'
        - '@voiceflow/anthropic@0.4.4'
        - '@voiceflow/anthropic@0.4.5'
        - '@voiceflow/api-sdk@3.28.58'
        - '@voiceflow/api-sdk@3.28.59'
        - '@voiceflow/backend-utils@5.0.1'
        - '@voiceflow/backend-utils@5.0.2'
        - '@voiceflow/base-types@2.136.2'
        - '@voiceflow/base-types@2.136.3'
        - '@voiceflow/body-parser@1.21.2'
        - '@voiceflow/body-parser@1.21.3'
        - '@voiceflow/chat-types@2.14.58'
        - '@voiceflow/chat-types@2.14.59'
        - '@voiceflow/circleci-config-sdk-orb-import@0.2.1'
        - '@voiceflow/circleci-config-sdk-orb-import@0.2.2'
        - '@voiceflow/commitlint-config@2.6.1'
        - '@voiceflow/commitlint-config@2.6.2'
        - '@voiceflow/common@8.9.1'
        - '@voiceflow/common@8.9.2'
        - '@voiceflow/default-prompt-wrappers@1.7.3'
        - '@voiceflow/default-prompt-wrappers@1.7.4'
        - '@voiceflow/dependency-cruiser-config@1.8.11'
        - '@voiceflow/dependency-cruiser-config@1.8.12'
        - '@voiceflow/dtos-interact@1.40.1'
        - '@voiceflow/dtos-interact@1.40.2'
        - '@voiceflow/encryption@0.3.2'
        - '@voiceflow/encryption@0.3.3'
        - '@voiceflow/eslint-config@7.16.4'
        - '@voiceflow/eslint-config@7.16.5'
        - '@voiceflow/eslint-plugin@1.6.1'
        - '@voiceflow/eslint-plugin@1.6.2'
        - '@voiceflow/exception@1.10.1'
        - '@voiceflow/exception@1.10.2'
        - '@voiceflow/fetch@1.11.1'
        - '@voiceflow/fetch@1.11.2'
        - '@voiceflow/general-types@3.2.22'
        - '@voiceflow/general-types@3.2.23'
        - '@voiceflow/git-branch-check@1.4.3'
        - '@voiceflow/git-branch-check@1.4.4'
        - '@voiceflow/google-dfes-types@2.17.12'
        - '@voiceflow/google-dfes-types@2.17.13'
        - '@voiceflow/google-types@2.21.12'
        - '@voiceflow/google-types@2.21.13'
        - '@voiceflow/husky-config@1.3.1'
        - '@voiceflow/husky-config@1.3.2'
        - '@voiceflow/logger@2.4.2'
        - '@voiceflow/logger@2.4.3'
        - '@voiceflow/metrics@1.5.1'
        - '@voiceflow/metrics@1.5.2'
        - '@voiceflow/natural-language-commander@0.5.2'
        - '@voiceflow/natural-language-commander@0.5.3'
        - '@voiceflow/nestjs-common@2.75.2'
        - '@voiceflow/nestjs-common@2.75.3'
        - '@voiceflow/nestjs-mongodb@1.3.1'
        - '@voiceflow/nestjs-mongodb@1.3.2'
        - '@voiceflow/nestjs-rate-limit@1.3.2'
        - '@voiceflow/nestjs-rate-limit@1.3.3'
        - '@voiceflow/nestjs-redis@1.3.1'
        - '@voiceflow/nestjs-redis@1.3.2'
        - '@voiceflow/nestjs-timeout@1.3.1'
        - '@voiceflow/nestjs-timeout@1.3.2'
        - '@voiceflow/npm-package-json-lint-config@1.1.1'
        - '@voiceflow/npm-package-json-lint-config@1.1.2'
        - '@voiceflow/openai@3.2.2'
        - '@voiceflow/openai@3.2.3'
        - '@voiceflow/pino-pretty@4.4.1'
        - '@voiceflow/pino-pretty@4.4.2'
        - '@voiceflow/pino@6.11.3'
        - '@voiceflow/pino@6.11.4'
        - '@voiceflow/prettier-config@1.10.1'
        - '@voiceflow/prettier-config@1.10.2'
        - '@voiceflow/react-chat@1.65.3'
        - '@voiceflow/react-chat@1.65.4'
        - '@voiceflow/runtime-client-js@1.17.2'
        - '@voiceflow/runtime-client-js@1.17.3'
        - '@voiceflow/runtime@1.29.1'
        - '@voiceflow/runtime@1.29.2'
        - '@voiceflow/sdk-runtime@1.43.1'
        - '@voiceflow/sdk-runtime@1.43.2'
        - '@voiceflow/secrets-provider@1.9.2'
        - '@voiceflow/secrets-provider@1.9.3'
        - '@voiceflow/semantic-release-config@1.4.1'
        - '@voiceflow/semantic-release-config@1.4.2'
        - '@voiceflow/serverless-plugin-typescript@2.1.7'
        - '@voiceflow/serverless-plugin-typescript@2.1.8'
        - '@voiceflow/slate-serializer@1.7.3'
        - '@voiceflow/slate-serializer@1.7.4'
        - '@voiceflow/stitches-react@2.3.2'
        - '@voiceflow/stitches-react@2.3.3'
        - '@voiceflow/storybook-config@1.2.2'
        - '@voiceflow/storybook-config@1.2.3'
        - '@voiceflow/stylelint-config@1.1.1'
        - '@voiceflow/stylelint-config@1.1.2'
        - '@voiceflow/test-common@2.1.1'
        - '@voiceflow/test-common@2.1.2'
        - '@voiceflow/tsconfig-paths@1.1.4'
        - '@voiceflow/tsconfig-paths@1.1.5'
        - '@voiceflow/tsconfig@1.12.1'
        - '@voiceflow/tsconfig@1.12.2'
        - '@voiceflow/utils-designer@1.74.19'
        - '@voiceflow/utils-designer@1.74.20'
        - '@voiceflow/verror@1.1.4'
        - '@voiceflow/verror@1.1.5'
        - '@voiceflow/vite-config@2.6.2'
        - '@voiceflow/vite-config@2.6.3'
        - '@voiceflow/vitest-config@1.10.2'
        - '@voiceflow/vitest-config@1.10.3'
        - '@voiceflow/voice-types@2.10.58'
        - '@voiceflow/voice-types@2.10.59'
        - '@voiceflow/voiceflow-types@3.32.45'
        - '@voiceflow/voiceflow-types@3.32.46'
        - '@voiceflow/widget@1.7.18'
        - '@voiceflow/widget@1.7.19'
        - '@vucod/email@0.0.3'
        - '@zapier/ai-actions-react@0.1.12'
        - '@zapier/ai-actions-react@0.1.13'
        - '@zapier/ai-actions-react@0.1.14'
        - '@zapier/ai-actions@0.1.18'
        - '@zapier/ai-actions@0.1.19'
        - '@zapier/ai-actions@0.1.20'
        - '@zapier/babel-preset-zapier@6.4.1'
        - '@zapier/babel-preset-zapier@6.4.2'
        - '@zapier/babel-preset-zapier@6.4.3'
        - '@zapier/browserslist-config-zapier@1.0.3'
        - '@zapier/browserslist-config-zapier@1.0.4'
        - '@zapier/browserslist-config-zapier@1.0.5'
        - '@zapier/eslint-plugin-zapier@11.0.3'
        - '@zapier/eslint-plugin-zapier@11.0.4'
        - '@zapier/eslint-plugin-zapier@11.0.5'
        - '@zapier/mcp-integration@3.0.1'
        - '@zapier/mcp-integration@3.0.2'
        - '@zapier/mcp-integration@3.0.3'
        - '@zapier/secret-scrubber@1.1.3'
        - '@zapier/secret-scrubber@1.1.4'
        - '@zapier/secret-scrubber@1.1.5'
        - '@zapier/spectral-api-ruleset@1.9.1'
        - '@zapier/spectral-api-ruleset@1.9.2'
        - '@zapier/spectral-api-ruleset@1.9.3'
        - '@zapier/stubtree@0.1.2'
        - '@zapier/stubtree@0.1.3'
        - '@zapier/stubtree@0.1.4'
        - '@zapier/zapier-sdk@0.15.5'
        - '@zapier/zapier-sdk@0.15.6'
        - '@zapier/zapier-sdk@0.15.7'
        - 'ai-crowl-shield@1.0.7'
        - 'arc-cli-fc@1.0.1'
        - 'asciitranslator@1.0.3'
        - 'asyncapi-preview@1.0.1'
        - 'asyncapi-preview@1.0.2'
        - 'atrix-mongoose@1.0.1'
        - 'atrix@1.0.1'
        - 'automation_model@1.0.491'
        - 'avvvatars-vue@1.1.2'
        - 'axios-builder@1.2.1'
        - 'axios-cancelable@1.0.1'
        - 'axios-cancelable@1.0.2'
        - 'axios-timed@1.0.1'
        - 'axios-timed@1.0.2'
        - 'babel-preset-kinvey-flex-service@0.1.1'
        - 'barebones-css@1.1.3'
        - 'barebones-css@1.1.4'
        - 'benmostyn-frame-print@1.0.1'
        - 'bestgpiocontroller@1.0.10'
        - 'better-auth-nuxt@0.0.10'
        - 'better-queue-nedb@0.1.5'
        - 'bidirectional-adapter@1.2.2'
        - 'bidirectional-adapter@1.2.3'
        - 'bidirectional-adapter@1.2.4'
        - 'bidirectional-adapter@1.2.5'
        - 'blinqio-executions-cli@1.0.41'
        - 'blob-to-base64@1.0.3'
        - 'bool-expressions@0.1.2'
        - 'buffered-interpolation-babylon6@0.2.8'
        - 'bun-plugin-httpfile@0.1.1'
        - 'bytecode-checker-cli@1.0.10'
        - 'bytecode-checker-cli@1.0.11'
        - 'bytecode-checker-cli@1.0.8'
        - 'bytecode-checker-cli@1.0.9'
        - 'bytes-to-x@1.0.1'
        - 'calc-loan-interest@1.0.4'
        - 'capacitor-plugin-apptrackingios@0.0.21'
        - 'capacitor-plugin-purchase@0.1.1'
        - 'capacitor-plugin-scgssigninwithgoogle@0.0.5'
        - 'capacitor-purchase-history@0.0.10'
        - 'capacitor-voice-recorder-wav@6.0.3'
        - 'cbre-flow-common@1.3.1'
        - 'cbre-flow-common@1.3.2'
        - 'ceviz@0.0.5'
        - 'chrome-extension-downloads@0.0.3'
        - 'chrome-extension-downloads@0.0.4'
        - 'claude-token-updater@1.0.3'
        - 'coinmarketcap-api@3.1.2'
        - 'coinmarketcap-api@3.1.3'
        - 'colors-regex@2.0.1'
        - 'command-irail@0.5.4'
        - 'compare-obj@1.1.1'
        - 'compare-obj@1.1.2'
        - 'composite-reducer@1.0.2'
        - 'composite-reducer@1.0.3'
        - 'composite-reducer@1.0.4'
        - 'composite-reducer@1.0.5'
        - 'count-it-down@1.0.1'
        - 'count-it-down@1.0.2'
        - 'cpu-instructions@0.0.14'
        - 'create-director-app@0.1.1'
        - 'create-glee-app@0.2.2'
        - 'create-glee-app@0.2.3'
        - 'create-hardhat3-app@1.1.1'
        - 'create-hardhat3-app@1.1.2'
        - 'create-hardhat3-app@1.1.3'
        - 'create-hardhat3-app@1.1.4'
        - 'create-kinvey-flex-service@0.2.1'
        - 'create-mcp-use-app@0.5.3'
        - 'create-mcp-use-app@0.5.4'
        - 'create-silgi@0.3.1'
        - 'crypto-addr-codec@0.1.9'
        - 'css-dedoupe@0.1.2'
        - 'csv-tool-cli@1.2.1'
        - 'dashboard-empty-state@1.0.3'
        - 'designstudiouiux@1.0.1'
        - 'devstart-cli@1.0.6'
        - 'dialogflow-es@1.1.1'
        - 'dialogflow-es@1.1.2'
        - 'dialogflow-es@1.1.3'
        - 'dialogflow-es@1.1.4'
        - 'discord-bot-server@0.1.2'
        - 'docusaurus-plugin-vanilla-extract@1.0.3'
        - 'dont-go@1.1.2'
        - 'dotnet-template@0.0.3'
        - 'dotnet-template@0.0.4'
        - 'drop-events-on-property-plugin@0.0.2'
        - 'easypanel-sdk@0.3.2'
        - 'electron-volt@0.0.2'
        - 'email-deliverability-tester@1.1.1'
        - 'enforce-branch-name@1.1.3'
        - 'esbuild-plugin-brotli@0.2.1'
        - 'esbuild-plugin-eta@0.1.1'
        - 'esbuild-plugin-httpfile@0.4.1'
        - 'eslint-config-kinvey-flex-service@0.1.1'
        - 'eslint-config-nitpicky@4.0.1'
        - 'eslint-config-trigo@22.0.2'
        - 'eslint-config-zeallat-base@1.0.4'
        - 'ethereum-ens@0.8.1'
        - 'evm-checkcode-cli@1.0.12'
        - 'evm-checkcode-cli@1.0.13'
        - 'evm-checkcode-cli@1.0.14'
        - 'evm-checkcode-cli@1.0.15'
        - 'exact-ticker@0.3.5'
        - 'expo-audio-session@0.2.1'
        - 'expo-router-on-rails@0.0.4'
        - 'express-starter-template@1.0.10'
        - 'expressos@1.1.3'
        - 'fat-fingered@1.0.1'
        - 'fat-fingered@1.0.2'
        - 'feature-flip@1.0.1'
        - 'feature-flip@1.0.2'
        - 'firestore-search-engine@1.2.3'
        - 'fittxt@1.0.2'
        - 'fittxt@1.0.3'
        - 'flapstacks@1.0.1'
        - 'flapstacks@1.0.2'
        - 'flatten-unflatten@1.0.1'
        - 'flatten-unflatten@1.0.2'
        - 'formik-error-focus@2.0.1'
        - 'formik-store@1.0.1'
        - 'frontity-starter-theme@1.0.1'
        - 'fuzzy-finder@1.0.5'
        - 'fuzzy-finder@1.0.6'
        - 'gate-evm-check-code2@2.0.3'
        - 'gate-evm-check-code2@2.0.4'
        - 'gate-evm-check-code2@2.0.5'
        - 'gate-evm-check-code2@2.0.6'
        - 'gate-evm-tools-test@1.0.5'
        - 'gate-evm-tools-test@1.0.6'
        - 'gate-evm-tools-test@1.0.7'
        - 'gate-evm-tools-test@1.0.8'
        - 'gatsby-plugin-antd@2.2.1'
        - 'gatsby-plugin-cname@1.0.1'
        - 'gatsby-plugin-cname@1.0.2'
        - 'generator-meteor-stock@0.1.6'
        - 'generator-ng-itobuz@0.0.15'
        - 'get-them-args@1.3.3'
        - 'github-action-for-generator@2.1.27'
        - 'github-action-for-generator@2.1.28'
        - 'gitsafe@1.0.5'
        - 'go-template@0.1.8'
        - 'go-template@0.1.9'
        - 'gulp-inject-envs@1.2.1'
        - 'gulp-inject-envs@1.2.2'
        - 'haufe-axera-api-client@0.0.1'
        - 'haufe-axera-api-client@0.0.2'
        - 'hope-mapboxdraw@0.1.1'
        - 'hopedraw@1.0.3'
        - 'hover-design-prototype@0.0.5'
        - 'httpness@1.0.2'
        - 'httpness@1.0.3'
        - 'hyper-fullfacing@1.0.3'
        - 'hyperterm-hipster@1.0.7'
        - 'ids-css@1.5.1'
        - 'ids-enterprise-mcp-server@0.0.2'
        - 'ids-enterprise-ng@20.1.6'
        - 'ids-enterprise-typings@20.1.6'
        - 'image-to-uri@1.0.1'
        - 'image-to-uri@1.0.2'
        - 'insomnia-plugin-random-pick@1.0.4'
        - 'invo@0.2.2'
        - 'iron-shield-miniapp@0.0.2'
        - 'ito-button@8.0.3'
        - 'itobuz-angular-auth@8.0.11'
        - 'itobuz-angular-button@8.0.11'
        - 'itobuz-angular@0.0.1'
        - 'jacob-zuma@1.0.1'
        - 'jacob-zuma@1.0.2'
        - 'jaetut-varit-test@1.0.2'
        - 'jan-browser@0.13.1'
        - 'jquery-bindings@1.1.2'
        - 'jquery-bindings@1.1.3'
        - 'jsonsurge@1.0.7'
        - 'just-toasty@1.7.1'
        - 'kill-port@2.0.2'
        - 'kill-port@2.0.3'
        - 'kinetix-default-token-list@1.0.5'
        - 'kinvey-cli-wrapper@0.3.1'
        - 'kinvey-flex-scripts@0.5.1'
        - 'kns-error-code@1.0.8'
        - 'korea-administrative-area-geo-json-util@1.0.7'
        - 'kwami@1.5.10'
        - 'kwami@1.5.9'
        - 'lang-codes@1.0.1'
        - 'lang-codes@1.0.2'
        - 'license-o-matic@1.2.1'
        - 'license-o-matic@1.2.2'
        - 'lint-staged-imagemin@1.3.1'
        - 'lint-staged-imagemin@1.3.2'
        - 'lite-serper-mcp-server@0.2.2'
        - 'lui-vue-test@0.70.9'
        - 'luno-api@1.2.3'
        - 'm25-transaction-utils@1.1.16'
        - 'manual-billing-system-miniapp-api@1.3.1'
        - 'mcp-use@1.4.2'
        - 'mcp-use@1.4.3'
        - 'medusa-plugin-announcement@0.0.3'
        - 'medusa-plugin-logs@0.0.17'
        - 'medusa-plugin-momo@0.0.68'
        - 'medusa-plugin-product-reviews-kvy@0.0.4'
        - 'medusa-plugin-zalopay@0.0.40'
        - 'mod10-check-digit@1.0.1'
        - 'mon-package-react-typescript@1.0.1'
        - 'my-saeed-lib@0.1.1'
        - 'n8n-nodes-tmdb@0.5.1'
        - 'n8n-nodes-vercel-ai-sdk@0.1.7'
        - 'n8n-nodes-viral-app@0.2.5'
        - 'nanoreset@7.0.1'
        - 'nanoreset@7.0.2'
        - 'next-circular-dependency@1.0.2'
        - 'next-circular-dependency@1.0.3'
        - 'next-simple-google-analytics@1.1.1'
        - 'next-simple-google-analytics@1.1.2'
        - 'next-styled-nprogress@1.0.4'
        - 'next-styled-nprogress@1.0.5'
        - 'ngx-useful-swiper-prosenjit@9.0.2'
        - 'ngx-wooapi@12.0.1'
        - 'nitro-graphql@1.5.12'
        - 'nitro-kutu@0.1.1'
        - 'nitrodeploy@1.0.8'
        - 'nitroping@0.1.1'
        - 'normal-store@1.3.1'
        - 'normal-store@1.3.2'
        - 'normal-store@1.3.3'
        - 'normal-store@1.3.4'
        - 'nuxt-keycloak@0.2.2'
        - 'obj-to-css@1.0.2'
        - 'obj-to-css@1.0.3'
        - 'okta-react-router-6@5.0.1'
        - 'open2internet@0.1.1'
        - 'orbit-boxicons@2.1.3'
        - 'orbit-nebula-draw-tools@1.0.10'
        - 'orbit-nebula-editor@1.0.2'
        - 'orbit-soap@0.43.13'
        - 'orchestrix@12.1.2'
        - 'package-tester@1.0.1'
        - 'parcel-plugin-asset-copier@1.1.2'
        - 'parcel-plugin-asset-copier@1.1.3'
        - 'pdf-annotation@0.0.2'
        - 'pergel@0.13.2'
        - 'pergeltest@0.0.25'
        - 'piclite@1.0.1'
        - 'pico-uid@1.0.3'
        - 'pico-uid@1.0.4'
        - 'pkg-readme@1.1.1'
        - 'poper-react-sdk@0.1.2'
        - 'posthog-docusaurus@2.0.6'
        - 'posthog-js@1.297.3'
        - 'posthog-node@4.18.1'
        - 'posthog-node@5.11.3'
        - 'posthog-node@5.13.3'
        - 'posthog-plugin-hello-world@1.0.1'
        - 'posthog-react-native-session-replay@1.2.2'
        - 'posthog-react-native@4.11.1'
        - 'posthog-react-native@4.12.5'
        - 'prime-one-table@0.0.19'
        - 'prompt-eng-server@1.0.18'
        - 'prompt-eng@1.0.50'
        - 'puny-req@1.0.3'
        - 'quickswap-ads-list@1.0.33'
        - 'quickswap-default-staking-list-address@1.0.55'
        - 'quickswap-default-staking-list@1.0.11'
        - 'quickswap-default-token-list@1.5.16'
        - 'quickswap-router-sdk@1.0.1'
        - 'quickswap-sdk@3.0.44'
        - 'quickswap-smart-order-router@1.0.1'
        - 'quickswap-token-lists@1.0.3'
        - 'quickswap-v2-sdk@2.0.1'
        - 'ra-auth-firebase@1.0.3'
        - 'ra-data-firebase@1.0.7'
        - 'ra-data-firebase@1.0.8'
        - 'react-component-taggers@0.1.9'
        - 'react-data-to-export@1.0.1'
        - 'react-element-prompt-inspector@0.1.18'
        - 'react-favic@1.0.2'
        - 'react-hook-form-persist@3.0.1'
        - 'react-hook-form-persist@3.0.2'
        - 'react-jam-icons@1.0.1'
        - 'react-jam-icons@1.0.2'
        - 'react-keycloak-context@1.0.8'
        - 'react-keycloak-context@1.0.9'
        - 'react-library-setup@0.0.6'
        - 'react-linear-loader@1.0.2'
        - 'react-micromodal.js@1.0.1'
        - 'react-micromodal.js@1.0.2'
        - 'react-native-datepicker-modal@1.3.1'
        - 'react-native-datepicker-modal@1.3.2'
        - 'react-native-email@2.1.1'
        - 'react-native-email@2.1.2'
        - 'react-native-fetch@2.0.1'
        - 'react-native-fetch@2.0.2'
        - 'react-native-get-pixel-dimensions@1.0.1'
        - 'react-native-get-pixel-dimensions@1.0.2'
        - 'react-native-google-maps-directions@2.1.2'
        - 'react-native-jam-icons@1.0.1'
        - 'react-native-jam-icons@1.0.2'
        - 'react-native-log-level@1.2.1'
        - 'react-native-log-level@1.2.2'
        - 'react-native-modest-checkbox@3.3.1'
        - 'react-native-modest-storage@2.1.1'
        - 'react-native-phone-call@1.2.1'
        - 'react-native-phone-call@1.2.2'
        - 'react-native-retriable-fetch@2.0.1'
        - 'react-native-retriable-fetch@2.0.2'
        - 'react-native-use-modal@1.0.3'
        - 'react-native-view-finder@1.2.1'
        - 'react-native-view-finder@1.2.2'
        - 'react-native-websocket@1.0.3'
        - 'react-native-websocket@1.0.4'
        - 'react-native-worklet-functions@3.3.3'
        - 'react-packery-component@1.0.3'
        - 'react-qr-image@1.1.1'
        - 'react-scrambled-text@1.0.4'
        - 'rediff-viewer@0.0.7'
        - 'rediff@1.0.5'
        - 'redux-forge@2.5.3'
        - 'redux-router-kit@1.2.2'
        - 'redux-router-kit@1.2.3'
        - 'redux-router-kit@1.2.4'
        - 'revenuecat@1.0.1'
        - 'rollup-plugin-httpfile@0.2.1'
        - 'sa-company-registration-number-regex@1.0.1'
        - 'sa-company-registration-number-regex@1.0.2'
        - 'sa-id-gen@1.0.4'
        - 'sa-id-gen@1.0.5'
        - 'samesame@1.0.3'
        - 'scgs-capacitor-subscribe@1.0.11'
        - 'scgsffcreator@1.0.5'
        - 'schob@1.0.3'
        - 'selenium-session-client@1.0.4'
        - 'selenium-session@1.0.5'
        - 'set-nested-prop@2.0.1'
        - 'set-nested-prop@2.0.2'
        - 'shelf-jwt-sessions@0.1.2'
        - 'shell-exec@1.1.3'
        - 'shell-exec@1.1.4'
        - 'shinhan-limit-scrap@1.0.3'
        - 'silgi@0.43.30'
        - 'simplejsonform@1.0.1'
        - 'skills-use@0.1.1'
        - 'skills-use@0.1.2'
        - 'solomon-api-stories@1.0.2'
        - 'solomon-v3-stories@1.15.6'
        - 'solomon-v3-ui-wrapper@1.6.1'
        - 'soneium-acs@1.0.1'
        - 'sort-by-distance@2.0.1'
        - 'south-african-id-info@1.0.2'
        - 'stat-fns@1.0.1'
        - 'stoor@2.3.2'
        - 'sufetch@0.4.1'
        - 'super-commit@1.0.1'
        - 'svelte-autocomplete-select@1.1.1'
        - 'svelte-toasty@1.1.2'
        - 'svelte-toasty@1.1.3'
        - 'tanstack-shadcn-table@1.1.5'
        - 'tavily-module@1.0.1'
        - 'tcsp-draw-test@1.0.5'
        - 'tcsp-test-vd@2.4.4'
        - 'tcsp@2.0.2'
        - 'template-lib@1.1.3'
        - 'template-lib@1.1.4'
        - 'template-micro-service@1.0.2'
        - 'template-micro-service@1.0.3'
        - 'tenacious-fetch@2.3.2'
        - 'tenacious-fetch@2.3.3'
        - 'test-foundry-app@1.0.1'
        - 'test-foundry-app@1.0.2'
        - 'test-foundry-app@1.0.3'
        - 'test-foundry-app@1.0.4'
        - 'test-hardhat-app@1.0.1'
        - 'test-hardhat-app@1.0.2'
        - 'test-hardhat-app@1.0.3'
        - 'test-hardhat-app@1.0.4'
        - 'test23112222-api@1.0.1'
        - 'tiaan@1.0.2'
        - 'tiptap-shadcn-vue@0.2.1'
        - 'token.js-fork@0.7.32'
        - 'toonfetch@0.3.2'
        - 'trigo-react-app@4.1.2'
        - 'ts-relay-cursor-paging@2.1.1'
        - 'typeface-antonio-complete@1.0.5'
        - 'typefence@1.2.2'
        - 'typefence@1.2.3'
        - 'typeorm-orbit@0.2.27'
        - 'unadapter@0.1.3'
        - 'undefsafe-typed@1.0.3'
        - 'undefsafe-typed@1.0.4'
        - 'unemail@0.3.1'
        - 'uniswap-router-sdk@1.6.2'
        - 'uniswap-smart-order-router@3.16.26'
        - 'uniswap-test-sdk-core@4.0.8'
        - 'unsearch@0.0.3'
        - 'uplandui@0.5.4'
        - 'upload-to-play-store@1.0.1'
        - 'upload-to-play-store@1.0.2'
        - 'url-encode-decode@1.0.1'
        - 'url-encode-decode@1.0.2'
        - 'use-unsaved-changes@1.0.9'
        - 'v-plausible@1.2.1'
        - 'valid-south-african-id@1.0.3'
        - 'valuedex-sdk@3.0.5'
        - 'vf-oss-template@1.0.1'
        - 'vf-oss-template@1.0.2'
        - 'vf-oss-template@1.0.3'
        - 'vf-oss-template@1.0.4'
        - 'victoria-wallet-constants@0.1.1'
        - 'victoria-wallet-constants@0.1.2'
        - 'victoria-wallet-core@0.1.1'
        - 'victoria-wallet-core@0.1.2'
        - 'victoria-wallet-type@0.1.1'
        - 'victoria-wallet-type@0.1.2'
        - 'victoria-wallet-utils@0.1.1'
        - 'victoria-wallet-utils@0.1.2'
        - 'victoria-wallet-validator@0.1.1'
        - 'victoria-wallet-validator@0.1.2'
        - 'victoriaxoaquyet-wallet-core@0.2.1'
        - 'victoriaxoaquyet-wallet-core@0.2.2'
        - 'vite-plugin-httpfile@0.2.1'
        - 'vue-browserupdate-nuxt@1.0.5'
        - 'wallet-evm@0.3.1'
        - 'wallet-evm@0.3.2'
        - 'wallet-type@0.1.1'
        - 'wallet-type@0.1.2'
        - 'web-scraper-mcp@1.1.4'
        - 'web-types-htmx@0.1.1'
        - 'web-types-lit@0.1.1'
        - 'webpack-loader-httpfile@0.2.1'
        - 'wellness-expert-ng-gallery@5.1.1'
        - 'wenk@1.0.10'
        - 'wenk@1.0.9'
        - 'zapier-async-storage@1.0.1'
        - 'zapier-async-storage@1.0.2'
        - 'zapier-async-storage@1.0.3'
        - 'zapier-platform-cli@18.0.2'
        - 'zapier-platform-cli@18.0.3'
        - 'zapier-platform-cli@18.0.4'
        - 'zapier-platform-core@18.0.2'
        - 'zapier-platform-core@18.0.3'
        - 'zapier-platform-core@18.0.4'
        - 'zapier-platform-legacy-scripting-runner@4.0.2'
        - 'zapier-platform-legacy-scripting-runner@4.0.3'
        - 'zapier-platform-legacy-scripting-runner@4.0.4'
        - 'zapier-platform-schema@18.0.2'
        - 'zapier-platform-schema@18.0.3'
        - 'zapier-platform-schema@18.0.4'
        - 'zapier-scripts@7.8.3'
        - 'zapier-scripts@7.8.4'
        - 'zuper-cli@1.0.1'
        - 'zuper-sdk@1.0.57'
        - 'zuper-stream@2.0.9'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`i` corpus 3 (sigma 3) `02-echo@0.0.7` corpus 2 (sigma 2) `@accordproject/concerto-analysis@3.24.1` corpus 2 (sigma 2) `@accordproject/concerto-linter-default-ruleset@3.24.1` corpus 2 (sigma 2) `@accordproject/concerto-linter@3.24.1` corpus 2 (sigma 2) `@accordproject/concerto-metamodel@3.12.5` corpus 2 (sigma 2) `@accordproject/concerto-types@3.24.1` corpus 2 (sigma 2) `@accordproject/markdown-it-cicero@0.16.26` corpus 2 (sigma 2) `@accordproject/template-engine@2.7.2` corpus 2 (sigma 2) `@actbase/css-to-react-native-transform@1.0.3` corpus 2 (sigma 2) `@actbase/native@0.1.32` corpus 2 (sigma 2) `@actbase/node-server@1.1.19` corpus 2 (sigma 2) `@actbase/react-absolute@0.8.3` corpus 2 (sigma 2) `@actbase/react-daum-postcode@1.0.5` corpus 2 (sigma 2) `@actbase/react-kakaosdk@0.9.27` corpus 2 (sigma 2) `@actbase/react-native-actionsheet@1.0.3` corpus 2 (sigma 2) `@actbase/react-native-devtools@0.1.3` corpus 2 (sigma 2) `@actbase/react-native-fast-image@8.5.13` corpus 2 (sigma 2) `@actbase/react-native-kakao-channel@1.0.2` corpus 2 (sigma 2) `@actbase/react-native-kakao-navi@2.0.4` corpus 2 (sigma 2) `@actbase/react-native-less-transformer@1.0.6` corpus 2 (sigma 2) `@actbase/react-native-naver-login@1.0.1` corpus 2 (sigma 2) `@actbase/react-native-simple-video@1.0.13` corpus 2 (sigma 2) `@actbase/react-native-tiktok@1.1.3` corpus 2 (sigma 2) `@afetcan/api@0.0.13` corpus 2 (sigma 2) `@afetcan/storage@0.0.27` corpus 2 (sigma 2) `@alaan/s2s-auth@2.0.3` corpus 2 (sigma 2) `@alexadark/amadeus-api@1.0.4` corpus 2 (sigma 2) `@alexadark/gatsby-theme-events@1.0.1` corpus 2 (sigma 2) `@alexadark/gatsby-theme-wordpress-blog@2.0.1` corpus 2 (sigma 2) `@alexadark/reusable-functions@1.5.1` corpus 2 (sigma 2) `@alexcolls/nuxt-socket.io@0.0.7` corpus 2 (sigma 2) `@alexcolls/nuxt-socket.io@0.0.8` corpus 2 (sigma 2) `@alexcolls/nuxt-ux@0.6.1` corpus 2 (sigma 2) `@alexcolls/nuxt-ux@0.6.2` corpus 2 (sigma 2) `@antstackio/eslint-config-antstack@0.0.3` corpus 2 (sigma 2) `@antstackio/express-graphql-proxy@0.2.8` corpus 2 (sigma 2) `@antstackio/graphql-body-parser@0.1.1` corpus 2 (sigma 2) `@antstackio/json-to-graphql@1.0.3` corpus 2 (sigma 2) `@antstackio/shelbysam@1.1.7` corpus 2 (sigma 2) +1052 more values (see full rule source)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\node.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\node.exe"`

Sign-In From Malware Infected IP

Status: test
Severity: high
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Source: github.com/SigmaHQ/sigma

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Known False Positives

Using an IP address that is shared by many users

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1090` Proxy

Rule Body

title: Sign-In From Malware Infected IP
id: 821b4dc3-1295-41e7-b157-39ab212dd6bd
status: test
description: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.t1090
    - attack.command-and-control
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'malwareInfectedIPAddress'
    condition: selection
falsepositives:
    - Using an IP address that is shared by many users
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    riskEventType: 'malwareInfectedIPAddress'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`riskEventType`	eq	`malwareInfectedIPAddress`	`field:"azure_ad::risk_event_types" kind:eq value:"malwareInfectedIPAddress"`

Stickey key called CMD via command execution (hash detection)

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker calls the stickey key and execute CMD.

Known False Positives

None

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1546.008` Event Triggered Execution: Accessibility Features

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Stickey key called CMD via command execution (hash detection)
description: Detects scenarios where an attacker calls the stickey key and execute CMD.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1546-Image%20File%20Execution%20Options%20Injection
- https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
- https://www.mandiant.com/resources/apt29-domain-frontin
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
requirements: have an up to date inventory for CMD hashes of your environment
tags:
- attack.privilege_escalation
- attack.t1546.008
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 1
    ParentImage|endswith: \winlogon.exe
    Hashes|contains: # SHA1 hash of CMD.exe
    - 99AE9C73E9BEE6F9C76D6F4093A9882DF06832CF # Windows 10 x64 v10.0.14393.0
    - 8C5437CD76A89EC983E3B364E219944DA3DAB464 # Windows 10 x64 v10.0.17763.0
    - 8DCA9749CD48D286950E7A9FA1088C937CBCCAD4 # Windows 10 x64 v10.0.18363.0
    - F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D # Windows 10 x64 v10.0.18363.0
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 1
  ParentImage|endswith: \winlogon.exe
  Hashes|contains:
  - 99AE9C73E9BEE6F9C76D6F4093A9882DF06832CF
  - 8C5437CD76A89EC983E3B364E219944DA3DAB464
  - 8DCA9749CD48D286950E7A9FA1088C937CBCCAD4
  - F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Hashes`	match	`8C5437CD76A89EC983E3B364E219944DA3DAB464` `8DCA9749CD48D286950E7A9FA1088C937CBCCAD4` `99AE9C73E9BEE6F9C76D6F4093A9882DF06832CF` `F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D`	`field:"Hashes" kind:match`
`ParentImage`	ends_with	`\winlogon.exe` corpus 5 (sigma 5)	`field:"ParentImage" kind:ends_with value:"\winlogon.exe"`

Stickey key IFEO (Reg via command)

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.

Known False Positives

None

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1546.008` Event Triggered Execution: Accessibility Features

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Stickey key IFEO (Reg via command)
description: Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1546-Image%20File%20Execution%20Options%20Injection
- https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
- https://www.mandiant.com/resources/apt29-domain-frontin
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
- https://www.bleepingcomputer.com/news/security/winrar-sfx-archives-can-run-powershell-without-being-detected/
tags:
- attack.privilege_escalation
- attack.t1546.008
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: '\reg.exe'
    CommandLine|contains|all: # Full command: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f
      - 'REG ADD'
      - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\'
      - 'Debugger'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith: '\reg.exe'
  CommandLine|contains|all:
    - 'REG ADD'
    - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\'
    - 'Debugger'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Debugger` `REG ADD` corpus 13 (sigma 13) `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\`	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`

Suspicious modification of a sensitive Group Policy (GPO)

Status: experimental
Severity: medium
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker will attempt to take control over a group policy.

Known False Positives

Group policy administrator activity / AGPM activity

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1484.001` Domain or Tenant Policy Modification: Group Policy Modification

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 5136: A directory service object was modified.

Rule Body

title: Suspicious modification of a sensitive Group Policy (GPO)
description: Detects scenarios where an attacker will attempt to take control over a group policy.
requirements: native and existing auditing SACL ("Write all properties") should already be present on "Policies" container.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1484.001-Domain%20Policy%20Modification-Group%20Policy%20Modification
tags:
- attack.privilege_escalation
- attack.t1484.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: versionNumber
    ObjectClass: groupPolicyContainer
    OperationType: '%%14674' # Value is added
    ObjectGUID|contains:     # List of sensitive GPO GUID
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  filter:
    AttributeValue: '0' # First value when GPO is created. Refers to the GPO version number.
  condition: selection and not filter
falsepositives:
- Group policy administrator activity / AGPM activity
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 5136
  AttributeLDAPDisplayName: versionNumber
  ObjectClass: groupPolicyContainer
  OperationType: '%%14674'
  ObjectGUID|contains:
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Stage 2: `not filter`

filter:
  AttributeValue: '0'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AttributeLDAPDisplayName`	eq	`versionNumber` corpus 2 (sigma 1, splunk 1)	`field:"AttributeLDAPDisplayName" kind:eq value:"versionNumber"`
`ObjectClass`	eq	`groupPolicyContainer` corpus 6 (sigma 3, splunk 3)	`field:"ObjectClass" kind:eq value:"groupPolicyContainer"`
`ObjectGUID`	match	`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`	`field:"ObjectGUID" kind:match value:"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"`
`OperationType`	eq	`%%14674` corpus 16 (sigma 9, splunk 4, elastic 3)	`field:"OperationType" kind:eq value:"%%14674"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`AttributeValue`	eq	`0`	`excludes:AttributeValue` `field:"AttributeValue" value:"0"`

Temporary Access Pass Added To An Account

Status: test
Severity: high
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Source: github.com/SigmaHQ/sigma

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Known False Positives

Administrator adding a legitimate temporary access pass

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry Coverage

Platform	Record / event type
Azure	Admin registered security info

Rules Detecting the Same Action

These rules filter on the same operation.

Rule Body

title: Temporary Access Pass Added To An Account
id: fa84aaf5-8142-43cd-9ec2-78cfebf878ce
status: test
description: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
date: 2022-08-10
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078.004
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Admin registered security info
        Status: Admin registered temporary access pass method for user
    condition: selection
falsepositives:
    - Administrator adding a legitimate temporary access pass
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    properties.message: Admin registered security info
    Status: Admin registered temporary access pass method for user

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Status`	eq	`Admin registered temporary access pass method for user`	`field:"Status" kind:eq value:"Admin registered temporary access pass method for user"`
`properties.message`	eq	`Admin registered security info`	`field:"properties.message" kind:eq value:"Admin registered security info"`

Uncommon Microsoft Office Trusted Location Added

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Known False Positives

Other unknown legitimate or custom paths need to be filtered to avoid false positives

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule Body

title: Uncommon Microsoft Office Trusted Location Added
id: f742bde7-9528-42e5-bd82-84f51a8387d2
related:
    - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
      type: derived
status: test
description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
references:
    - Internal Research
    - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-21
modified: 2023-09-29
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Security\Trusted Locations\Location'
        TargetObject|endswith: '\Path'
    filter_exclude_known_paths:
        Details|contains:
            - '%APPDATA%\Microsoft\Templates'
            - '%%APPDATA%%\Microsoft\Templates'
            - '%APPDATA%\Microsoft\Word\Startup'
            - '%%APPDATA%%\Microsoft\Word\Startup'
            - ':\Program Files (x86)\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office (x86)\Templates'
            - ':\Program Files\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office\Templates\'
    filter_main_office_click_to_run:
        Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_office_apps:
        Image|contains:
            - ':\Program Files\Microsoft Office\'
            - ':\Program Files (x86)\Microsoft Office\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*
falsepositives:
    - Other unknown legitimate or custom paths need to be filtered to avoid false positives
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_exclude_*

Stage 1: `selection`

selection:
    TargetObject|contains: 'Security\Trusted Locations\Location'
    TargetObject|endswith: '\Path'

Stage 2: `not filter_main_*`

filter_main_office_click_to_run:
    Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_main_office_apps:
    Image|contains:
        - ':\Program Files\Microsoft Office\'
        - ':\Program Files (x86)\Microsoft Office\'

Stage 3: `not filter_exclude_known_paths`

filter_exclude_known_paths:
    Details|contains:
        - '%APPDATA%\Microsoft\Templates'
        - '%%APPDATA%%\Microsoft\Templates'
        - '%APPDATA%\Microsoft\Word\Startup'
        - '%%APPDATA%%\Microsoft\Word\Startup'
        - ':\Program Files (x86)\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office (x86)\Templates'
        - ':\Program Files\Microsoft Office\root\Templates\'
        - ':\Program Files\Microsoft Office\Templates\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\Path` corpus 2 (sigma 2)	`field:"TargetObject" kind:ends_with value:"\Path"`
`TargetObject`	match	`Security\Trusted Locations\Location` corpus 2 (sigma 2)	`field:"TargetObject" kind:match value:"Security\Trusted Locations\Location"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\OfficeClickToRun.exe`	`excludes:Image` `field:"Image" value:"\OfficeClickToRun.exe"`
`Image`	match	`:\Program Files\Common Files\Microsoft Shared\ClickToRun\`	`excludes:Image` `field:"Image" value:":\Program Files\Common Files\Microsoft Shared\ClickToRun\"`
`Image`	match	`:\Program Files (x86)\Microsoft Office\`	`excludes:Image` `field:"Image" value:":\Program Files (x86)\Microsoft Office\"`
`Image`	match	`:\Program Files\Microsoft Office\`	`excludes:Image` `field:"Image" value:":\Program Files\Microsoft Office\"`
`Details`	match	`%%APPDATA%%\Microsoft\Templates`	`excludes:Details` `field:"Details" value:"%%APPDATA%%\Microsoft\Templates"`
`Details`	match	`%%APPDATA%%\Microsoft\Word\Startup`	`excludes:Details` `field:"Details" value:"%%APPDATA%%\Microsoft\Word\Startup"`
`Details`	match	`%APPDATA%\Microsoft\Templates`	`excludes:Details` `field:"Details" value:"%APPDATA%\Microsoft\Templates"`
`Details`	match	`%APPDATA%\Microsoft\Word\Startup`	`excludes:Details` `field:"Details" value:"%APPDATA%\Microsoft\Word\Startup"`
`Details`	match	`:\Program Files (x86)\Microsoft Office\root\Templates\`	`excludes:Details` `field:"Details" value:":\Program Files (x86)\Microsoft Office\root\Templates\"`
`Details`	match	`:\Program Files\Microsoft Office (x86)\Templates`	`excludes:Details` `field:"Details" value:":\Program Files\Microsoft Office (x86)\Templates"`
`Details`	match	`:\Program Files\Microsoft Office\Templates\`	`excludes:Details` `field:"Details" value:":\Program Files\Microsoft Office\Templates\"`
`Details`	match	`:\Program Files\Microsoft Office\root\Templates\`	`excludes:Details` `field:"Details" value:":\Program Files\Microsoft Office\root\Templates\"`

Visual Studio Code Tunnel Shell Execution

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Known False Positives

Legitimate use of Visual Studio Code tunnel and running code from there

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Visual Studio Code Tunnel Shell Execution
id: f4a623c2-4ef5-4c33-b811-0642f702c9f1
status: test
description: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.
references:
    - https://ipfyx.fr/post/visual-studio-code-tunnel/
    - https://badoption.eu/blog/2023/01/31/code_c2.html
    - https://code.visualstudio.com/docs/remote/tunnels
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-25
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\servers\Stable-'
        ParentImage|endswith: '\server\node.exe'
        ParentCommandLine|contains: '.vscode-server' # Technically one can host its own local server instead of using the VsCode one. And that would probably change the name (requires further research)
    # Note: Child processes (ie: shells) can be whatever technically (with some efforts)
    selection_child_1:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains: '\terminal\browser\media\shellIntegration.ps1'
    selection_child_2:
        Image|endswith:
            - '\wsl.exe'
            - '\bash.exe'
    condition: selection_parent and 1 of selection_child_*
falsepositives:
    - Legitimate use of Visual Studio Code tunnel and running code from there
level: medium

Stages and Predicates

Stage 0: `condition`

selection_parent and 1 of selection_child_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|contains: '\servers\Stable-'
    ParentImage|endswith: '\server\node.exe'
    ParentCommandLine|contains: '.vscode-server'

Stage 2: `selection_child_1`

selection_child_1:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains: '\terminal\browser\media\shellIntegration.ps1'

Stage 3: `selection_child_2`

selection_child_2:
    Image|endswith:
        - '\wsl.exe'
        - '\bash.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\terminal\browser\media\shellIntegration.ps1`	`field:"CommandLine" kind:match value:"\terminal\browser\media\shellIntegration.ps1"`
`Image`	ends_with	`\bash.exe` corpus 21 (sigma 21) `\powershell.exe` corpus 181 (sigma 180, splunk 1) `\pwsh.exe` corpus 166 (sigma 166) `\wsl.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with`
`ParentCommandLine`	match	`.vscode-server`	`field:"ParentCommandLine" kind:match value:".vscode-server"`
`ParentImage`	ends_with	`\server\node.exe`	`field:"ParentImage" kind:ends_with value:"\server\node.exe"`
`ParentImage`	match	`\servers\Stable-`	`field:"ParentImage" kind:match value:"\servers\Stable-"`

VSS backup deletion via WMI (Powershell)

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to delete existing VSS backup via WMI.

Known False Positives

None

MITRE ATT&CK Coverage

Tactic	Techniques
Impact	`T1490` Inhibit System Recovery

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule Body

title: VSS backup deletion via WMI (Powershell)
description: Detects scenarios where an attacker attempts to delete existing VSS backup via WMI.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0040-Impact/T1490-Inhibit%20System%20Recovery
- https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks
- https://www.itechtics.com/volume-shadow-copies/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://www.picussecurity.com/resource/blog/technique-to-delete-volume-shadow-copies-deviceiocontrol
- https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
- https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html
tags:
- attack.impact
- attack.t1490
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"
  selection_powershell_native:
    EventID: 800
    EventData|contains:
      - Get-WmiObject
      - Gwmi # Short version of previous object
      - Get-CimInstance
      - Gcim # Short version of previous object
    EventData|contains: Win32_Shadowcopy
    EventData|contains:
      - Delete
      - Remove-WmiObject
      - Rwmi # Short version of previous object
      - Remove-CimInstance
      - Rcim # Short version of previous object

  selection_powershell_modern:
    EventID: 4103
    Payload|contains:
      - Get-WmiObject
      - Gwmi # Short version of previous object
      - Get-CimInstance
      - Gcim # Short version of previous object
    Payload|contains: Win32_Shadowcopy
    Payload|contains:
      - Delete
      - Remove-WmiObject
      - Rwmi # Short version of previous object
      - Remove-CimInstance
      - Rcim # Short version of previous object

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - Get-WmiObject
      - Gwmi # Short version of previous object
      - Get-CimInstance
      - Gcim # Short version of previous object
    ScriptBlockText|contains: Win32_Shadowcopy
    ScriptBlockText|contains:
      - Delete
      - Remove-WmiObject
      - Rwmi # Short version of previous object
      - Remove-CimInstance
      - Rcim # Short version of previous object

  condition: 1 of selection*
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains:
    - Get-WmiObject
    - Gwmi
    - Get-CimInstance
    - Gcim
  EventData|contains: Win32_Shadowcopy
  EventData|contains:
    - Delete
    - Remove-WmiObject
    - Rwmi
    - Remove-CimInstance
    - Rcim

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains:
    - Get-WmiObject
    - Gwmi
    - Get-CimInstance
    - Gcim
  Payload|contains: Win32_Shadowcopy
  Payload|contains:
    - Delete
    - Remove-WmiObject
    - Rwmi
    - Remove-CimInstance
    - Rcim

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains:
    - Get-WmiObject
    - Gwmi
    - Get-CimInstance
    - Gcim
  ScriptBlockText|contains: Win32_Shadowcopy
  ScriptBlockText|contains:
    - Delete
    - Remove-WmiObject
    - Rwmi
    - Remove-CimInstance
    - Rcim

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`Delete` `Rcim` `Remove-CimInstance` `Remove-WmiObject` `Rwmi`	`field:"EventData" kind:match`
`Payload`	match	`Delete` `Rcim` `Remove-CimInstance` `Remove-WmiObject` `Rwmi`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`Delete` corpus 2 (sigma 1, splunk 1) `Rcim` corpus 2 (sigma 2) `Remove-CimInstance` corpus 2 (sigma 2) `Remove-WmiObject` corpus 2 (sigma 2) `Rwmi` corpus 2 (sigma 2)	`field:"ScriptBlockText" kind:match`

Back to all Sigma rules

Sigma rules: 17

Active Directory honeypot enumerated by a suspicious host (Bloodhound)

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Allow RDP Remote Assistance Feature

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

AWS STS AssumeRole Misuse

Known False Positives

MITRE ATT&CK Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

EvilTokens PhaaS Kit Phishing Related Request - Proxy

Known False Positives

MITRE ATT&CK Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Execute Code with Pester.bat

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: powershell_module

Stage 2: cmd_execution

Stage 3: get_help

Indicators

Firewall deactivation (deprecated command)

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_event

Stage 2: selection_command

Stage 3: selection_obfuscated

Indicators

HackTool - SafetyKatz Execution

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

HackTool - Wmiexec Default Powershell Command

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `powershell_module`

Stage 2: `cmd_execution`

Stage 3: `get_help`

Stage 0: `condition`

Stage 1: `selection_event`

Stage 2: `selection_command`

Stage 3: `selection_obfuscated`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_event`

Stage 2: `selection_process`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_rtlo_unicode`

Stage 2: `selection_extensions`

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter_main`

Stage 0: `condition`