DNS queries to known malicious C2 domains from axios/plain-crypto-js npm compromise indicators

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
- T1568Dynamic Resolution
Exfiltration
Impact

What it detects

This rule flags DNS traffic where endpoints attempt to resolve specific domains identified as command-and-control infrastructure tied to the axios/plain-crypto-js npm supply chain compromise. Attackers rely on resolving these domains to establish outbound communication for follow-on payload behavior. The detection relies on DNS query telemetry matching the configured suspicious domain names.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

DNS queries to known malicious C2 domains from axios/plain-crypto-js npm compromise indicators

Pivot detection · T1071.001 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

detect-suspicious-dns-queries-to-axios-supply-chain-c2-domains-73e5d24f

title: DNS queries to known malicious C2 domains from axios/plain-crypto-js npm compromise indicators
id: 7ba3fcaf-1dad-4ab7-9705-32ae9e21f8dd
status: experimental
description: This rule flags DNS traffic where endpoints attempt to resolve specific domains identified as command-and-control infrastructure tied to the axios/plain-crypto-js npm supply chain compromise. Attackers rely on resolving these domains to establish outbound communication for follow-on payload behavior. The detection relies on DNS query telemetry matching the configured suspicious domain names.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/net_dns_axios_npm_compromise_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1568
  - detection.emerging-threats
logsource:
  category: dns
detection:
  selection:
    query:
      - sfrclak.com
      - calltan.com
      - callnrwise.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 73e5d24f-493f-4092-bd2f-c72cabda40ee
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL