Query: detection rule: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Matching passage: Sigma rule: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud. Logsource: windows / process_creation. Rule: title: Node Process Executions id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e status: test description: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud references: - https://twitter.com/mttaggart/status/1511804863293784064 author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.execution - attack.stealth - attack.t1127 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Adobe Creative Cloud Experience\libs\node.exe filter: CommandLine|contains: Adobe Creative Cloud Experience\js condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects creation of specific system DLL files that are usually not present on the system (or at least not in system dir. Logsource: windows / file_event. Rule: title: Creation Of Non-Existent System DLL id: df6ecb8b-7822-4f4b-b412-08f524b4576c related: - id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 type: similar status: test description: 'Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), fornotes date: 2022-12-01 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll - \SprintCSP.dll condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/fil