huntrule

Windows File Creation Indicators for Axios NPM Compromise Drops (node.exe/powershell.exe)

Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.

FreeUnreviewedSigmahighv1
title: Windows File Creation Indicators for Axios NPM Compromise Drops (node.exe/powershell.exe)
id: c6f0371e-c83b-4e7e-989b-9f3d2c996fe7
status: experimental
description: This rule identifies Windows file creation events associated with a suspected Axios NPM supply-chain compromise, focusing on specific executables and script payloads created in user temp and ProgramData. Attackers use these artifacts to deliver and execute malicious post-install behavior via Windows scripting and command utilities. The detection relies on file event telemetry that records the creating image path (node.exe or powershell.exe) and the target filenames/paths created under C:\ProgramData and C:\Users\...\AppData\Local\Temp.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_win_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \node.exe
      - \powershell.exe
  selection_fils:
    - TargetFilename:
        - C:\ProgramData\wt.exe
        - C:\ProgramData\system.bat
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.vbs
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.ps1
  condition: all of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1
related:
  - id: cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
    type: derived

What it detects

This rule identifies Windows file creation events associated with a suspected Axios NPM supply-chain compromise, focusing on specific executables and script payloads created in user temp and ProgramData. Attackers use these artifacts to deliver and execute malicious post-install behavior via Windows scripting and command utilities. The detection relies on file event telemetry that records the creating image path (node.exe or powershell.exe) and the target filenames/paths created under C:\ProgramData and C:\Users\...\AppData\Local\Temp.

Known false positives

  • Highly unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.