Potential Execution of DenoGate Backdoor via Microsoft Teams Delivery

Detects suspicious execution of 'deno.exe' with indicators suggesting DenoGate backdoor, particularly when delivered through Microsoft Teams.

Sigmamediumv12026-07-28

sigmapotential-execution-of-denogate-backdoor-via-microsoft-teams-delivery-ed6483b0

title: Potential Execution of DenoGate Backdoor via Microsoft Teams Delivery
id: 786e193d-ef8c-48c0-90dc-51ae42b8e2c8
description: Detects the execution of the DenoGate backdoor, potentially delivered via Microsoft Teams, by identifying suspicious 'deno' process invocations commonly associated with this malware.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\deno.exe'
    CommandLine|contains|all:
      - 'run'
      - 'http'
      - 'denogate'  # used as example; tune for observed indicators
  condition: selection
level: medium
references:
  - https://www.esentire.com/blog/trust-me-im-it-threat-actors-deliver-deno-based-backdoor-denogate-via-microsoft-teams
tags:
  - attack.t1566.002  # Phishing: Spearphishing via Service
  - attack.t1059.006  # Command and Scripting Interpreter: JavaScript/JScript
falsepositives:
  - Legitimate use of deno for development or automation; tune as appropriate.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.