Windows: Deno writes files from remote HTTPS content into AppData

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1059.007JavaScript
- T1204User Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule matches Windows file events where the target path contains Deno-generated remote HTTPS directories and also includes a user AppData location (e.g., ':\Users\' and '\AppData\'). Attackers may abuse Deno to fetch content over HTTP(s) and place it into writable application data folders to stage execution artifacts. Telemetry relied on is Windows file event data, specifically the TargetFilename path reported by the endpoint.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious Inline node.exe Command Executing Network and Process Spawning Code

Suspicious Deno Runtime Execution of Remote JavaScript Payload (via process_creation)

macOS: In-Memory Download and Compile via curl and osacompile in a Single Command

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Malicious Curl MSI Download to ProgramData via Process Creation

Suspicious CloudZ RAT Payload Download via curl to ProgramData

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

Windows: Deno writes files from remote HTTPS content into AppData

Pivot detection · T1105 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-deno-writing-files-to-appdata-from-remote-https-sources-6c0ce3b6

title: "Windows: Deno writes files from remote HTTPS content into AppData"
id: 7b502f3c-bf99-4c54-8a9a-a7f567497684
status: experimental
description: This rule matches Windows file events where the target path contains Deno-generated remote HTTPS directories and also includes a user AppData location (e.g., ':\Users\' and '\AppData\'). Attackers may abuse Deno to fetch content over HTTP(s) and place it into writable application data folders to stage execution artifacts. Telemetry relied on is Windows file event data, specifically the TargetFilename path reported by the endpoint.
references:
  - https://taggart-tech.com/evildeno/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_deno.yml
author: Josh Nickels, Michael Taggart, Huntrule Team
date: 2025-05-22
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.007
  - attack.command-and-control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - \deno\gen\
      - \deno\remote\https\
    TargetFilename|contains|all:
      - :\Users\
      - \AppData\
  condition: selection_path
falsepositives:
  - Legitimate usage of deno to request a file or bring a DLL to a host
level: low
license: DRL-1.1
related:
  - id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL