{"id":"d87100fd-60cc-4899-a5d0-10423873eb1d","title":"Deno Runtime Spawns Shell Or Scripting Interpreter","description":"Detects suspicious child process execution from the Deno runtime, a behavior useful for MuddyWater/Dindoor-inspired hunting.","author":"Andrey Pautov","status":"experimental","level":"medium","date":"2026-05-13","modified":"","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Developer automation using Deno to orchestrate local shell commands."],"references":["https://www.threathunter.ai/blog/stryker-handala-mois-muddywater-unified-brief-detection-pack-v3"],"source_path":"rules/windows/process_creation/proc_creation_win_deno_susp_child_process.yml","source_sha256":"12f2e0e5e7432334af7112c944c20df57aab8c5fa1f47d4eb4e375ceb40cae10","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_deno_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Deno Runtime Spawns Shell Or Scripting Interpreter\nid: d87100fd-60cc-4899-a5d0-10423873eb1d\nstatus: experimental\ndescription: Detects suspicious child process execution from the Deno runtime, a behavior useful for MuddyWater/Dindoor-inspired hunting.\nreferences:\n    - https://www.threathunter.ai/blog/stryker-handala-mois-muddywater-unified-brief-detection-pack-v3\nauthor: Andrey Pautov\ndate: 2026-05-13\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\deno.exe'\n    selection_child:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'\n    condition: selection_parent and selection_child\nfields:\n    - UtcTime\n    - Computer\n    - User\n    - ParentImage\n    - Image\n    - CommandLine\nfalsepositives:\n    - Developer automation using Deno to orchestrate local shell commands.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/d87100fd-60cc-4899-a5d0-10423873eb1d.json","kind":"sigma"}