DetectSuspiciousScriptPatterns

NOVA detection rule by Thomas Roccia (@fr0gger_) · MIT

Detects suspicious patterns in bundled scripts that may indicate malicious intent

rule DetectSuspiciousScriptPatterns {
    meta:
        description = "Detects suspicious patterns in bundled scripts that may indicate malicious intent"
        uuid = "f22c8dda-3827-458c-aebb-dee2dbb86414"
        author = "Thomas Roccia (@fr0gger_)"
        version = "1.0.0"
        severity = "high"
        category = "abusing_functions/supply_chain"
        date = "2026-03-25"

    keywords:
        // Dynamic code execution
        $eval = "eval("
        $exec = "exec("
        $compile = "compile("
        $code_object = "__code__"

        // Remote code execution
        $curl_pipe = "curl | bash"
        $curl_pipe2 = "curl|bash"
        $wget_pipe = "wget | sh"
        $wget_pipe2 = "wget|sh"
        $remote_exec = "remote_exec"

        // Data exfiltration patterns
        $env_access = "os.environ"
        $getenv = "getenv("
        $env_vars = "process.env"
        $credentials = "credentials"
        $api_key = "api_key"
        $secret_key = "secret_key"
        $password = "password"
        $token_access = "access_token"

        // Obfuscation techniques
        $base64_decode = "base64 -d"
        $base64_decode2 = "base64.b64decode"
        $base64_decode3 = "atob("
        $hex_decode = "bytes.fromhex"
        $rot13 = "rot13"
        $encode_decode = ".encode().decode()"

        // Backdoor patterns
        $reverse_shell = "reverse shell"
        $bind_shell = "bind shell"
        $socket_connect = "socket.connect"
        $paramiko = "paramiko"
        $fabric = "fabric"
        $pexpect = "pexpect"

        // Pickle/deserialization (RCE risk)
        $pickle_load = "pickle.load"
        $pickle_loads = "pickle.loads"
        $marshal_load = "marshal.load"
        $yaml_load = "yaml.load("

    semantics:
        $exfiltration = "send data to external server or endpoint" (0.4)
        $backdoor = "establish persistent access or reverse shell" (0.4)
        $obfuscation = "obfuscate or hide malicious code" (0.3)
        $rce = "execute arbitrary code from remote source" (0.4)

    condition:
        any of keywords.* or any of semantics.*
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3de31f01-d126-419b-b0c2-41274ea1e303

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion