huntrule

Suspicious node.exe Execution From LocalAppData Directory

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-09
Updated
2026-10-09
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Node.js runtime node.exe running from a user LocalAppData nodejs directory, the location abused by the Tsundere botnet. The malware ships its own Node.js runtime under %LOCALAPPDATA%\nodejs and executes malicious JavaScript through it. Legitimate Node installations typically live under Program Files, so a node.exe launched from LocalAppData indicates a bundled malicious runtime executing attacker script.

Reporting behind it

Related detections9 linkedT1059.007 — drag to rearrange
Suspicious Script Host Spawned by cmd for DarkGate Execution
Suspicious Script Interpreter Executing JavaScript from Temp Folder
Suspicious FrostyNeighbor WinDataScope JavaScript Dropper Artifact
Malicious Nimbus RAT Java Archive Execution From ProgramData
Suspicious node.exe Spawning PowerShell Get-Clipboard
Suspicious Script Host Launching PowerShell from Fattura Named JScript File (via process_creation)
Malicious Python Execution from Hidden .pyp Directory in Lazarus InvisibleFerret Chain (via process_creation)
Suspicious Double-Extension PDF JavaScript Lure via WScript (via process_creation)
Suspicious Script Host Spawning PowerShell from Fake Browser Update JS
Suspicious node.exe Execution From LocalAppData Directory
Pivot detection · T1059.007 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.