Windows Deno Writing Files to AppData from Remote HTTPS Sources

Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.

FreeUnreviewedSigmalowv1

windows-deno-writing-files-to-appdata-from-remote-https-sources-6c0ce3b6

title: Windows Deno Writing Files to AppData from Remote HTTPS Sources
id: 7b502f3c-bf99-4c54-8a9a-a7f567497684
status: experimental
description: This rule flags file creation events where Deno writes output under paths consistent with remote HTTPS fetching (\deno\remote\https\) and where the target location is within a user AppData directory. This behavior can indicate an attempt to place remotely sourced content or accompanying components onto the host for later execution or use. The detection relies on Windows file event telemetry capturing the target filename/path associated with the write activity.
references:
  - https://taggart-tech.com/evildeno/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_deno.yml
author: Josh Nickels, Michael Taggart, Huntrule Team
date: 2025-05-22
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.007
  - attack.command-and-control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - \deno\gen\
      - \deno\remote\https\
    TargetFilename|contains|all:
      - :\Users\
      - \AppData\
  condition: selection_path
falsepositives:
  - Legitimate usage of deno to request a file or bring a DLL to a host
level: low
license: DRL-1.1
related:
  - id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
    type: derived

What it detects

This rule flags file creation events where Deno writes output under paths consistent with remote HTTPS fetching (\deno\remote\https\) and where the target location is within a user AppData directory. This behavior can indicate an attempt to place remotely sourced content or accompanying components onto the host for later execution or use. The detection relies on Windows file event telemetry capturing the target filename/path associated with the write activity.

Known false positives

Legitimate usage of deno to request a file or bring a DLL to a host

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.