Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitra. Logsource: windows / image_load. Rule: title: Unsigned .node File Loaded id: e5f5c693-52d7-4de5-88ae-afbfbce85595 status: experimental description: 'Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications. ' references: - https://www.coreycburton.com/blog/driploader-case-study - https://github.com/CoreyCBurton/DripLoaderNG - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron author: Jonathan Beierle (@hullabrian) date: 2025-11-22 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1129 - attack.t1574.001 - attack.t1036.005 logsource: category: image_load product: windows detection: selection_node_extension: ImageLoaded|endswith: .node selection_status: - Signed: 'false' - SignatureStatus: Unavailable filter_optional_vscode_jupyter: Image|endswith: \Code.exe ImageLoaded|contains: .vscode\extensions\ms-toolsai.jupyter- ImageLoaded|endswith: - \electron.napi.node - \node.napi.glibc.node condition: all of selection_* and not 1 of filter_optional_* falsepositives: - VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign. level: medium
Near-miss passage: Sigma rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe CommandLine|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: selection falsepositives: - Unknown level: high