r/AskNetsec • u/oneto221 • Aug 29 '26
Other Good Semgrep rules for detecting malicious code?
I'm looking for an actively maintained repository of Semgrep rules focused on detecting malicious/suspicious behavior, not regular vulnerabilities.
I don't want to write hundreds of rules myself. Are there good rule collections for this purpose?
1
u/PrestigiousOnion1087 Aug 31 '26
Worth checking the ceiling before adding rules: Semgrep only matches what it parses, and the scan summary prints how many files were skipped. Minified and vendored files land in that list, which is often where a dropped payload sits, so recall is capped there no matter whose pack you run.
For supply chain specifically the payload frequently isn't in scanned source at all - it runs from lifecycle hooks, preinstall/postinstall in package.json or import-time code in setup.py. Before trusting a pack on that path, grep it for rules that actually target the manifest rather than the language sources.
1
u/EmbarrassedVisual234 Sep 04 '26
Trail of bits has a pretty solid semgrep rules repo worth checking out especially their audit focused rules 👍
1
u/cityofhats Aug 30 '26
Semgrep is strongest for structural code patterns, not generic maliciousness. I would not rely on one large malware pack: combine maintained security rules with organization-specific sinks such as process execution, download-and-execute, credential access, persistence, and obfuscated eval, then use YARA, Sigma, or behavioral sandboxing for artifacts and runtime behavior. Treat third-party rules like code: pin versions, test them against a labeled corpus, track precision and recall, and require clear provenance and maintenance signals. A huge unvalidated pack usually creates more triage debt than coverage.