Suspicious Unsigned .node File Loaded (via image_load)

title: Suspicious Unsigned .node File Loaded (via image_load)
id: ffac92f4-a493-5411-9c80-2cc820c69b0f
status: stable
description: This rule detects the loading of unsigned .node files. Adversaries may misuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are frequently used for desktop applications like Slack, Discord, and Visual Studio Code. This method has been observed in the DripLoader malware, which uses unsigned .node files to load hostile native code into Electron applications.
references:
    - https://attack.mitre.org/techniques/T1036/005/
    - https://attack.mitre.org/techniques/T1574/001/
    - https://attack.mitre.org/techniques/T1129/
    - https://www.coreycburton.com/blog/driploader-case-study
    - https://github.com/CoreyCBurton/DripLoaderNG
    - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
author: Huntrule Team
date: 2026-06-28
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.persistence
    - attack.stealth
    - attack.t1129
    - attack.t1574.001
    - attack.t1036.005
logsource:
    category: image_load
    product: windows
detection:
    selection_node_extension:
        ImageLoaded|endswith: '.node'
    selection_status:
        - Signed: 'false'
        - SignatureStatus: 'Unavailable'
    filter_optional_vscode_jupyter:
        Image|endswith: '\Code.exe'
        ImageLoaded|contains: '.vscode\extensions\ms-toolsai.jupyter-'
        ImageLoaded|endswith:
            - '\electron.napi.node'
            - '\node.napi.glibc.node'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium