Deno Runtime Spawns Shell Or Scripting Interpreter — Sigma Rule

Rule metadata and linked tags

Author: Andrey Pautov. Source status: experimental; severity: medium. Source dates: 2026-05-13 / not supplied.

{
  "product": "windows",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 12f2e0e5e7432334af7112c944c20df57aab8c5fa1f47d4eb4e375ceb40cae10

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Deno Runtime Spawns Shell Or Scripting Interpreter
id: d87100fd-60cc-4899-a5d0-10423873eb1d
status: experimental
description: Detects suspicious child process execution from the Deno runtime, a behavior useful for MuddyWater/Dindoor-inspired hunting.
references:
    - https://www.threathunter.ai/blog/stryker-handala-mois-muddywater-unified-brief-detection-pack-v3
author: Andrey Pautov
date: 2026-05-13
tags:
    - attack.execution
    - attack.t1059
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\deno.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
fields:
    - UtcTime
    - Computer
    - User
    - ParentImage
    - Image
    - CommandLine
falsepositives:
    - Developer automation using Deno to orchestrate local shell commands.
level: medium

Original YAML and metadata in JSON

False positives

• Developer automation using Deno to orchestrate local shell commands.

Source references

• https://www.threathunter.ai/blog/stryker-handala-mois-muddywater-unified-brief-detection-pack-v3