huntrule

Suspicious Node.js Spawning PowerShell Archive Download to Temp

PremiumReviewedSigma · Medium · v1
Category
process_creation
Author
HuntRule
Published
2026-08-07
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a Node.js process spawning PowerShell to download a compressed archive into the user temp directory, a chain seen when a malicious npm postinstall hook stages a payload. In the MUT-4831 campaign node.exe launched PowerShell to retrieve a zip that unpacked the Vidar infostealer. This process lineage is unusual for legitimate development workflows and points to supply chain compromise.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Bun Runtime Spawned by Node During npm Lifecycle
Suspicious Node Package Install Spawning Script Interpreters via process_creation
Suspicious Node.js Spawning Script Interpreter for Dropped Payload
Malicious PowerShell Download from bullethost.cloud Staging Server
Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation
Suspicious node.exe Execution Spawned by PowerShell
Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Suspicious Node.js Spawning PowerShell Archive Download to Temp
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.