huntrule

Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-19
Updated
2026-09-19
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a PowerShell binary renamed to wt.exe and executed from the ProgramData directory as seen in the Axios npm supply chain compromise. The RAT masquerades its interpreter to evade process name based detection and blend with Windows Terminal, enabling stealthy execution of downloaded payloads.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation
Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)
Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe
Windows: Process executions matching Greenbug espionage tool indicators
Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise
Suspicious ClickFix PowerShell Execution with Hidden Window (via process_creation)
Suspicious Encoded PowerShell Execution with No Profile
Suspicious PowerShell Encoded Command Execution
Suspicious PowerShell BITS Transfer of DLL Payload via process_creation
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.