huntrule

Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-09-22
Updated
2026-09-22
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named wt.exe executing from the ProgramData directory. The legitimate Windows Terminal binary ships under WindowsApps, so a wt.exe copy in ProgramData is the SILKBELL loader masquerading through the axios npm supply chain compromise. Placing a renamed payload in a trusted-sounding location evades name-based allowlisting.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Malicious Contagious Interview RAT via Masqueraded Service Binary in User Path
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise
Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation
Suspicious Print Filter Pipeline Host Running Outside System32 via Process Creation
Malicious TELEPUZ DLL Persistence via Masqueraded Loader in User Path
Malicious Fseventsd Masquerade in Users Shared Directory via File Event
Malicious TALONITE GUP.exe Proxy Masquerading as Notepad++ Updater (via process_creation)
Scheduled Task Masquerading as Microsoft Wininet Config
Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.