{"id":"8537c866-072e-460d-bfff-aaf39cbd73d3","title":"Potentially Suspicious Inline JavaScript Execution via NodeJS Binary","description":"Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.","author":"Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-21","modified":"","tags":["attack.execution","attack.t1059.007"],"technique_ids":["T1059.007"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate scripts using Node.js with these modules"],"references":["https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_inline_node_js_execution.yml","source_sha256":"0664002eb69366eb2516ec2ffb174f84deabb8f5c35431912cba229ed79756e8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_inline_node_js_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Inline JavaScript Execution via NodeJS Binary\nid: 8537c866-072e-460d-bfff-aaf39cbd73d3\nstatus: experimental\ndescription: Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/\nauthor: Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-04-21\ntags:\n    - attack.execution\n    - attack.t1059.007\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\node.exe'\n        - OriginalFileName: 'node.exe'\n        - Product: 'Node.js'\n    selection_cmd:\n        CommandLine|contains|all:\n            - 'http'\n            - 'execSync'\n            - 'spawn'\n            - 'fs'\n            - 'path'\n            - 'zlib'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate scripts using Node.js with these modules\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"}],"data_path":"data/detection-rules/8537c866-072e-460d-bfff-aaf39cbd73d3.json","kind":"sigma"}