Good Semgrep rules for detecting malicious code?

[u/oneto221]

I'm looking for an actively maintained repository of Semgrep rules focused on detecting malicious/suspicious behavior, not regular vulnerabilities.

I don't want to write hundreds of rules myself. Are there good rule collections for this purpose?

[u/Mindless-Text8187]

Trail of Bits has a solid set they keep updated, worth checking their GitHub. Not a complete solution but it catches a lot of the obvious backdoors and weird eval patterns without you having to reinvent the wheel.

[u/Swimming_dasa]

check semgrep's registry first then look at community rulesets around malware supply chain and suspicious behavior the trick is usually turning out noisy generic vuln rules rather than finding on prefect malicious code pack.

[u/Responsible-Safe-636]

Yes. The closest match is Apiiro’s malicious-code-ruleset.

[u/cityofhats]

Semgrep is strongest for structural code patterns, not generic maliciousness. I would not rely on one large malware pack: combine maintained security rules with organization-specific sinks such as process execution, download-and-execute, credential access, persistence, and obfuscated eval, then use YARA, Sigma, or behavioral sandboxing for artifacts and runtime behavior. Treat third-party rules like code: pin versions, test them against a labeled corpus, track precision and recall, and require clear provenance and maintenance signals. A huge unvalidated pack usually creates more triage debt than coverage.

[u/PrestigiousOnion1087]

Worth checking the ceiling before adding rules: Semgrep only matches what it parses, and the scan summary prints how many files were skipped. Minified and vendored files land in that list, which is often where a dropped payload sits, so recall is capped there no matter whose pack you run.

For supply chain specifically the payload frequently isn't in scanned source at all - it runs from lifecycle hooks, preinstall/postinstall in package.json or import-time code in setup.py. Before trusting a pack on that path, grep it for rules that actually target the manifest rather than the language sources.