Query: detect Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js in logs
Matching passage: Sigma rule: Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js. Logsource: windows / process_creation. Rule: title: NodeJS Execution of JavaScript File id: ba3874b9-0fae-465f-836c-eb5d071a1789 status: experimental description: 'Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation. ' references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains: .js condition: all of selection_* falsepositives: - Legitimate use of node.exe to execute JavaScript or JSC files on your environment level: low
Near-miss passage: Sigma rule: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.. Logsource: windows / process_creation. Rule: title: Suspicious Process Created Via Wmic.EXE id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 related: - id: 526be59f-a573-4eea-b5f7-f0973207634d type: derived status: test description: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc. references: - https://thedfirreport.com/2020/10/08/ryuks-return/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-10-12 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'process ' - 'call ' - 'create ' CommandLine|contains: - rundll32 - bitsadmin - regsvr32 - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - powershell - pwsh - certutil - cscript - wscript - mshta - \Users\Public\ - \Windows\Temp\ - \AppData\Local\ - '%temp%' - '%tmp%' - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' condition: selection falsepositives: - Unknown level: high simulation: - type: atomic red team name: WMI Execute rundll32 technique: T1047 atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml